GMO Internet has begun shutting down Onamae Desktop Cloud servers after unauthorized parties accessed the Japanese virtual private server service and installed unauthorized software in some customer environments.
Up to 26,739 customer servers may be affected, according to a BleepingComputer report published on October 21, 2026. That figure represents potentially exposed servers, not a confirmed count of compromised systems or affected customers.
The company confirmed the unauthorized access and software installation on October 20, 2026. The available account does not specify when the intrusion occurred or when it was first detected.
Server shutdown disrupts every Desktop Cloud plan
Beginning at 04:00 local time on October 21, GMO Internet started progressively shutting down customer servers as a containment measure. All Desktop Cloud plans are affected by the resulting service interruption, and no restart date has been announced.
Onamae Desktop Cloud is marketed in part to foreign-exchange traders who use virtual servers to keep MetaTrader 4 (MT4) running continuously. The shutdown means customers cannot depend on those hosted environments for uninterrupted automated trading until service is restored.
The incident concerns Onamae Desktop Cloud, a VPS offering operated by GMO Internet, which belongs to GMO Internet Group. Onamae.com also provides domain registration, hosting, DNS and other infrastructure services, but the report does not identify those services as affected.
Unauthorized programs found in some customer environments
GMO Internet said a third party gained unauthorized access to the service’s infrastructure and installed unauthorized programs on some customer servers. BleepingComputer characterized that software as malware.
The distinction in scope is significant: the company’s statement confirms installations in “some” environments, while the 26,739 figure is the maximum number of servers potentially affected. It does not establish that every server within that scope received the unauthorized software.
The reported information does not identify the software involved or explain how access was obtained. The investigation remains in progress, and the company has said it will publish further updates as more details become available.
Stored server data may have been exposed
According to the company, information held on affected servers may have been exposed. It has not confirmed that data was leaked or misused.
GMO Internet said payment data, including credit card details, is kept on separate infrastructure and was not affected by this incident.
Customers who stored passwords or other secrets on their Desktop Cloud servers have been told to rotate them as soon as possible. That action should include replacing exposed credentials wherever they were reused, rather than changing them only inside the unavailable server environment.
The company also warned customers to expect an increased risk of phishing and unsolicited communications. It said it “will never ask” for passwords or credit card information through email or telephone. Customers should therefore reject such requests even if a message claims to concern restoration of the Desktop Cloud service.
