GMO Internet Group has confirmed that an unauthorized third party installed malicious programs in customer server environments of its Onamae.com Desktop Cloud service in Japan. As many as 26,739 servers were affected, and the company has shut down the service.
What GMO Confirmed About the Compromise
GMO confirmed the compromise on October 20. It began progressively shutting down customer servers at 04:00 local time on October 21, and the shutdown covers all Desktop Cloud plans. The company has given no date for restarting the service.
The company said data on affected servers may have been exposed, but it has not confirmed any misuse. Payment data is stored in a different system and was not affected.
An FX Trading Service Marketed Around MetaTrader 4
Onamae Desktop Cloud is marketed for automated foreign exchange trading, including use with MetaTrader 4. Customers of such a service often keep trading software and account credentials on their hosted servers, which makes the data on these systems potentially valuable.
Guidance GMO Gave to Customers
GMO told customers who stored passwords or other secrets on the servers to rotate them. It also warned of follow-on phishing, a risk that applies if customer details were exposed.
Scale of the Servers Involved
The figure of 26,739 is an upper limit, stated as “up to,” so the company has not said how many of those servers were found to contain malicious programs. The shutdown applies to all plans, not only the servers where malware was confirmed.
Open Questions About the Intrusion
GMO has not publicly described how the attacker gained access to the customer server environments, what the malicious programs do or how long they were present. The company’s statement that malicious programs were installed implies the intruder had the ability to write to customer servers, but the route into the provider’s infrastructure has not been disclosed.
That distinction matters for understanding the scope. If the intruder worked through the provider’s management layer, a single point of compromise could account for the large server count. If the attacker gained access in another way, the pattern would differ. GMO has not said which it was.
What GMO Has and Has Not Confirmed About Exposed Data
GMO said data on affected servers may have been exposed, which is a statement of possibility rather than confirmation. It has confirmed no misuse. Payment data sits in a separate system, so card and billing details were outside the affected environment. The company’s guidance to rotate passwords and other secrets applies to anything customers kept on the servers themselves, such as trading account logins.
Service Outage for Tens of Thousands of Customers
Tens of thousands of virtual private server customers have lost service. For traders running automated strategies, an outage with no restart date means their systems are not running, and the cause is a provider-side incident rather than anything they did.
Where the Onamae Desktop Cloud Investigation Stands
As of the company’s latest notice, the investigation continues and the servers remain offline. GMO’s disclosure includes the date of confirmation, the shutdown time, the maximum server count and the statement on payment data. It lacks the cause, the malware identity and the restoration timeline.
Phishing Warning for Desktop Cloud Customers
GMO’s warning about follow-on phishing is tied to the possibility that customer data on the servers was exposed. The company said it has not confirmed any misuse of that data, and it has not said whether it has seen phishing attempts so far.
The incident lands in the same week as Railway’s disclosure that customer environment variables may have been decrypted. The two cases are unrelated on the available information.
