Onamae Desktop Cloud review: Security Analysis After Malware Incident

Onamae Desktop Cloud, operated by GMO Internet, experienced unauthorized access confirmed on October 20, 2026. Attackers installed malicious programs on customer VPS environments used primarily for FX trading automation. Up to 26,739 servers across all plans may have been affected, though the exact number of infected instances remains under investigation.

The service provides Windows-based virtual desktops for persistent remote operation. GMO halted new sign-ups and control panel access on October 20 while beginning sequential shutdowns the following day to limit further damage. No resumption timeline has been announced pending full safety verification.

Onamae breach timeline and confirmed details

Investigation began on October 19 after a customer inquiry. Malicious programs were identified on October 20, prompting immediate service restrictions. Shutdown procedures started around 4:00 JST on October 21, with a second update released on October 22.

GMO stated that no confirmed leakage or misuse of personal information has occurred and that the company does not store payment or credit card data on this infrastructure. Data on affected servers may have been viewed, but specific intrusion methods and malware variants have not been disclosed. The company is consulting with police and external security firms.

Customer reports of unauthorized activity on linked trading accounts have surfaced. All plans remain suspended, leaving the service unavailable during the containment period. Updates will continue as the investigation progresses.

Practical steps for users after the Onamae incident

Customers should change all IDs and passwords previously stored or used on Onamae servers, performing these resets from a separate device. Reused credentials on other accounts require immediate updates as well. Enabling two-factor authentication on trading and related platforms reduces further exposure risks.

Monitor trading accounts for any unauthorized transactions and watch for phishing attempts that reference the incident. GMO has advised users to verify all communications through official channels only.

• Review server access logs if backups remain available.
• Scan local machines that connected to the VPS for signs of compromise.
• Document any financial losses and contact relevant financial institutions.

Service resumption depends on verification that environments are clean. Users should track official GMO and Onamae announcements for the next steps rather than attempting to restore operations prematurely.