GMO Internet confirms Onamae.com Desktop Cloud breach; up to 26,739 customer servers may carry malware, stolen data published
The extortion deadline passed on 2026-10-27 with customer data now public and credentials from the hosted desktops already being used for unauthorized trades, so any key still live on one of those instances is being exercised this week.
GMO Internet detected an intrusion into its Onamae.com Desktop Cloud VPS/virtual-desktop service on 2026-10-20 that could have installed malware on as many as 26,739 customer servers. GMO shut the servers down, refused a ~$50M extortion demand, and on 2026-10-27 the attacker published data that GMO confirmed belongs to both the company and its customers; a broker has tied unauthorized FX trades to logins leaked from the service.
Affected: GMO Internet Onamae.com Desktop Cloud — customer VPS/virtual desktop instances active on or after 2026-10-20; GMO Internet Onamae Desktop Cloud — Windows desktops used for FX trading
How to Test
Check GMO's customer notifications and control panel for whether your tenant is among the ~26,739 flagged servers; from a clean machine review FX/broker and banking account activity for unauthorized orders since 2026-10-21, pull authentication logs for your VPN, cloud and SaaS accounts for logins sourced from the Onamae hosting ranges, and if you can mount the disk offline inspect it for unexpected scheduled tasks, services and run-key persistence rather than booting it.
How to Mitigate
Do not restore or reconnect the original instances — rebuild Onamae Desktop Cloud workloads from clean images on a different host, rotate all passwords, API keys, certificates and MFA seeds that touched those desktops, invalidate existing sessions/refresh tokens for any service reached from them, and ask brokers and payment providers to re-verify recent transactions.