Japan Onamae Desktop Cloud hacked; up to 26,739 servers potentially affected and all plans shut down

Sourcing note: this report rests on a single reporting chain. BleepingComputer's October 21, 2026 report of GMO Internet's own announcement is the only credible outlet found covering the incident this cycle; the only other coverage found is a summary of that same announcement, not an independent source. GMO has not confirmed any leak or misuse of data, and the 26,739 figure is the company's potentially affected total, not a count of confirmed infected servers. This item will be updated when independent confirmation or a further company update appears.

GMO Internet confirmed on October 20, 2026 that an unauthorized third party accessed its Onamae Desktop Cloud service in Japan and installed malicious programs in some customer server environments. After detecting the intrusion, the company progressively shut down customer servers beginning at 04:00 local time on October 21, 2026; all Desktop Cloud plans are impacted and no date has been given for restarting the service. Up to 26,739 customer servers are potentially affected. GMO says data stored on the impacted servers may have been exposed, but it has not confirmed any instance of information being leaked or misused, and payment information such as credit card details is stored on separate infrastructure and is not affected. Customers who stored passwords or other secrets on their servers are advised to rotate them as soon as possible, and the company warns of an increased risk of phishing emails exploiting the incident.

Update, October 27: the incident has escalated into open extortion, and independent reporting has now appeared, so the single chain sourcing note above no longer governs the new facts. In its October 27 notices GMO said the suspected attackers would publish customer information and launch a ransomware attack at 12:00 PM JST on October 27, and told all Onamae Desktop Cloud users to back up their data, disconnect, shut down, and unplug their PCs before noon. GMO refuses the demand of about 8 billion yen (about $50 to 51 million). After the deadline, NHK reported the attackers said they had disclosed one client's information; that is an attacker claim, not a confirmed disclosure. Finance Minister Katayama said servers for five FX margin trading services (Goldenway Japan, OANDA, AvaTrade Japan, Gaitame Finest, and Dukascopy Japan) were breached and unauthorized trades were made, and those firms suspended trades for affected account holders. GMO said that as of 1:55 PM JST on October 27 no ransomware attack had been confirmed.

Update, October 28: GMO Internet Group opened the GMO Cybercrime Bounty on October 28, offering up to $1 million in total for tips that lead to an arrest or an international wanted notice, running to October 27, 2027 at the latest. GMO confirmed that the attackers' leak site domain, including its mirrors, was shut down at about 4:00 AM JST on October 28. GMO will not restart Desktop Cloud on the breached systems; customers who want a Windows desktop will be offered migration to a separate service, free for six months and only with their consent. As of October 28, GMO still had not stated how the attackers got in.

Sources: BleepingComputer; The Japan Times via Europe Says; Japan Cyber Watch; The Hacker News