1. News
  2. Alerts
  3. Japan · Cloud breach
AlertJapan · Cloud breach2 min read

Hackers plant malware on up to 26,739 rented servers in Japan

A Japanese server rental service says hackers installed malware on up to 26,739 customer servers. If you store passwords on rented servers, the clock is ticking.

By the Dashline deskSource: BleepingComputer
Hackers plant malware on up to 26,739 rented servers in Japan
Photo: Victorgrigas, CC BY-SA 3.0
Act this week
What happenedHackers got into Onamae Desktop Cloud and installed malicious programs on up to 26,739 customer servers.
Who is affectedCustomers of Onamae.com Desktop Cloud by GMO, including traders who run automated FX trading software on these servers.
What to do
  1. 1Change every password and key that was stored on an affected server.
  2. 2Assume data on those servers may have been seen, even though no leak is confirmed.
  3. 3Ignore emails or calls asking for passwords or card details, since the company says it never asks.
  4. 4Check the company's announcements for updates on when service will restart.

Hackers broke into Onamae Desktop Cloud, a popular server rental service in Japan, and installed malware on up to 26,739 customer servers. The company confirmed the break-in on October 20, 2026. It began shutting down customer servers at 4 a.m. local time on October 21.

What happened

Onamae.com is run by GMO Internet. Desktop Cloud is a VPS service, which means customers rent a virtual server that stays on around the clock. The company advertises it for automated currency trading with MetaTrader 4. It says an unauthorized third party installed "malicious programs" in some customers' server environments. The shutdown covers all Desktop Cloud plans.

Who can relax

Card details are safe, the company says, because payment information is stored on separate systems. Data on the affected servers may have been exposed. Still, the company has not confirmed any case of information being misused or leaked.

Anything stored on an affected server, such as passwords, may be compromised. The alert box above lists the steps to take.

What to watch for

Criminals often use news like this to trick people. The company warns of more phishing emails and unsolicited messages. It says it will never ask for a password or card information by email or phone. No restart date has been given. The company has not said how the attackers got in, and "up to 26,739" means the final count of hit servers could be lower. GMO says it will post updates as its investigation continues.

The takeaway

If you use Onamae Desktop Cloud, change any password stored on your server and treat messages asking for logins or card details as suspect.

More articles

You should really read these.

Next step

Let’s talk