Skip to content
NewA calmer, faster ZeroHour
StoryData breachhigh

GMO shuts Onamae Desktop Cloud after malware on up to 26,739 servers

3 sources · 3 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

GMO has shut down all Onamae Desktop Cloud plans after malware was found in some customer servers, with no restart date.

GMO Internet confirmed unauthorized access to Onamae.com Desktop Cloud, a Japanese virtual-server service used for automated foreign-exchange trading, and said a third party installed malicious programs in some customer environments. On October 21 it began shutting down every Desktop Cloud plan from 4:00 a.m. Japan time. It listed up to 26,739 servers as potentially affected, not as confirmed infections, and gave no restart date. Data on those servers may have been viewed, but GMO has not confirmed a leak or named the malware, and says payment-card data is not held on the service. Customers were told to rotate stored secrets. On October 22, OANDA Japan warned that MetaTrader 4 and 5 logins used on Desktop Cloud may have been viewed, without confirming unauthorized trades.

Key facts
  • Onamae.com Desktop Cloud is run by GMO Internet for continuous MetaTrader trading.
  • Malicious programs were confirmed in some environments on October 20, 2026.
  • 26,739 is a possible-scope count, not a verified infection total.
  • Every Desktop Cloud plan is offline, with no estimated restart.
  • No malware name, entry point, hashes, or attacker identity was published.
  • GMO says it will not request passwords or card data by email or phone.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 20, 2026GMO confirmed malware in some customer environments · GBHackers
  2. Oct 21, 2026Shutdown of all Desktop Cloud plans began at 04:00 · BleepingComputer
  3. Oct 22, 2026OANDA warned MT4 and MT5 logins may have been viewed · GBHackers

What each outlet adds

beyond the shared facts
  • BleepingComputerSays card data sits on separate infrastructure and flags phishing.
  • GBHackersAdds OANDA Japan's warning about MetaTrader 4 and 5 logins.
  • Cyber Security NewsShutdown covers every plan, not only confirmed infected hosts.
Vendors
GMO InternetOnamae.com
Products
Onamae Desktop CloudOnamae.com Desktop CloudMetaTrader 4MetaTrader 5Desktop Cloud
Victims
Onamae Desktop Cloud customers
Organizations
GMO Internet GroupOnamae.comOANDA Japan
Countries
Japan

Coverage

oldest first · one row per article · UTC
  1. · 4d ago BleepingComputerFirst report

    Onamae Desktop Cloud hacked; malware on up to 26,739 servers

    GMO shut down Desktop Cloud servers from 04:00 local time on October 21 and told customers to rotate stored secrets.

  2. · 3d ago GBHackers

    Malware planted on Onamae.com Desktop Cloud; 26,739 servers flagged

    GMO shut every Desktop Cloud plan after October 20, and OANDA warned MT4 and MT5 logins may have been viewed.

  3. · 3d ago Cyber Security News

    Onamae shuts Desktop Cloud after malware on customer servers

    The provider lists 26,739 servers as potentially affected and has not set a restart date.