Japanese internet services provider GMO Internet has suspended its Onamae.com Desktop Cloud platform after discovering that attackers installed malicious software in customer server environments. The security incident could affect as many as 26,739 servers, raising concerns about unauthorized access to information stored on the company’s cloud infrastructure.
The company identified the intrusion on October 20, 2026, and confirmed that an unauthorized third party had deployed malicious programs on some customer servers. To contain the incident and prevent additional damage, GMO began shutting down servers at 4 a.m. local time on October 21.
The shutdown applies to every Onamae.com Desktop Cloud subscription plan, regardless of whether an individual customer’s server was confirmed to be compromised. GMO has not announced when the service will resume, leaving affected customers unable to access their hosted environments during the interruption.
Onamae.com is a major Japanese domain registration and internet infrastructure provider that also offers hosting and cloud services. Its Desktop Cloud platform provides virtual private servers commonly used for automated foreign exchange trading, including applications such as MetaTrader 4 and MetaTrader 5 that require continuous operation.
The company warned that attackers may have viewed information stored within affected server environments. However, it has not confirmed that customer personal information was leaked or that any potentially accessed data has been misused.
GMO also clarified that it does not retain payment information, including credit card details, within the affected service. Consequently, the incident does not appear to involve the company’s payment records, although the investigation into customer server data remains ongoing.
The figure of 26,739 represents servers potentially affected by the intrusion rather than a confirmed number of infected systems. The company has not disclosed how many servers contained malicious programs, what type of malware was installed, or how the attackers initially gained access.
Customers who stored account credentials, passwords, or other authentication information on their servers have been advised to change those details immediately. GMO also recommends updating passwords used on other services if the same credentials were reused.
The provider has additionally warned about phishing emails and suspicious communications exploiting the incident. It emphasized that legitimate representatives will not request passwords or credit card information through email or telephone calls.