Cybersecurity
Onamae Desktop Cloud reports server compromise
GMO Internet said an unauthorised third party entered Onamae.com Desktop Cloud, installed malicious software in some customer environments and led the company to shut down affected servers while it investigated.
- The company said an unauthorised third party had accessed Onamae.com Desktop Cloud and installed malicious programs in some customer server environments.
- The article said up to 26,739 customer servers were affected.
- GMO said it began shutting down customer servers at 04:00 local time on 21 October 2026.
- The company said it had not confirmed any misuse or leak of information, and that payment details were stored on separate infrastructure.
- GMO warned customers to change secrets such as passwords and said the incident could lead to phishing attempts.
GMO Internet said it had found unauthorised access to Onamae.com Desktop Cloud and that malicious software had been placed in some customers’ server environments. The article said the compromise affected up to 26,739 customer servers.
After discovering the intrusion, the company said it started turning off customer servers at 04:00 local time on 21 October 2026. It said all Desktop Cloud plans were affected and that it had not set a date for restoration.
The company said data on the affected servers may have been exposed, but it had not confirmed that any information had been misused or leaked. It also said credit card details were stored elsewhere and were not affected.
GMO advised customers to rotate passwords and other secrets stored on their servers. It also warned that attackers might use the incident to send phishing messages or other unsolicited communications.
Named in this story
Companies
- GMO Internet
- The company that operated Onamae.com and issued the breach update.
Organisations
- GMO Internet Group
- The wider group to which GMO Internet belonged.
Products and systems
- Onamae.com Desktop Cloud
- The VPS service whose infrastructure was compromised.
How the source tells it
The piece was a straightforward incident report, with only limited caution in the company’s warnings about possible exposure and phishing.
No emotive framing was found in the original.