Onamae Desktop Cloud review: October 2026 VPS breach and compensation process

The Onamae Desktop Cloud service operated by GMO Internet experienced a significant security incident in October 2026. Attackers gained access to customer Windows VPS servers, installed malware, exfiltrated stored credentials, and executed unauthorized trades in linked FX accounts. GMO Internet confirmed the compromise on October 20 after an initial customer report on October 19.

Details of the Onamae Desktop Cloud breach

Attackers exploited vulnerabilities in the service infrastructure to move laterally across systems. They accessed saved login details within MT4 and MT5 trading platforms and performed trades that produced realized losses for some users. No credit card or payment data resided on the affected servers, according to GMO Internet statements. The service supported automated 24/7 trading and had up to 26,739 servers that could have been exposed.

Investigators confirmed data exfiltration and system weaknesses by October 24. GMO Internet consulted police on October 22 and refused ransom demands published by the attackers. Servers were shut down starting October 21 at 4:00 JST, and the platform remains offline with no plans to restart the current environment. The incident affected accounts at more than 70 securities and FX firms in Japan and overseas.

Official announcements from GMO Internet outlined the timeline and confirmed that customer protection remains the priority. The company requested government-level active cyber defense measures while continuing investigation with external experts.

Compensation and user support measures

GMO Internet offered a flat ¥5,000 condolence payment to all current users, with payment details scheduled for release by October 30, 2026. Verified realized trading losses and associated fees from confirmed unauthorized transactions qualify for separate compensation, after deduction of any refunds already received from brokers. Applications for loss compensation must be submitted by November 6.

Users who wish to continue using similar services receive six months of free access to an alternative platform hosted on a separate infrastructure. Market fluctuation losses and indirect damages fall outside the compensation scope. All communications about payments and service transitions occur through official email channels and the GMO Internet website.

Steps users should take after the incident

Customers must change all trading account passwords and terminate active sessions from unaffected devices. Enabling two-factor authentication on every linked account reduces further risk. Scanning personal computers and smartphones with updated antivirus software and creating fresh backups helps identify any secondary infections.

Account holders should monitor FX statements daily and contact their brokers immediately about unrecognized trades. Avoiding links in unsolicited messages prevents phishing attempts that often follow publicized incidents. GMO Internet continues to issue updates through official channels as the investigation proceeds.