GMO Shuts Down Onamae Desktop Cloud After Server Breach

A cyberattack against Onamae.com Desktop Cloud, a hosting service operated by Japan's GMO Internet, has potentially affected up to 27,000 servers. The company confirmed on October 20, 2026, that an unauthorized party installed malicious programs in some customer environments, prompting a shutdown of customer servers beginning at 4 a.m. local time on October 21.

According to the company's security announcement, the intrusion may have exposed information stored on affected servers. GMO Internet has not confirmed any cases of data theft, unauthorized disclosure, or misuse resulting from the incident.

The company said payment information, including credit card details, remains unaffected because it is stored on separate infrastructure. However, customers who saved passwords or other sensitive credentials on their servers have been advised to change them promptly.

GMO Internet confirmed the unauthorized access and installation of malicious software in its announcement regarding the incident.

"We have confirmed that unauthorized access by a third party occurred against Onamae.com Desktop Cloud and that unauthorized programs were installed in some customers’ server environments," the company said.

The shutdown affects all plans offered through Desktop Cloud byGMO. The company has not announced an estimated date for restoring service, leaving customers without a confirmed timeline for resuming operations.

GMO Internet also warned that the incident could increase the risk of phishing attempts and other unsolicited communications. Attackers could exploit customer concerns about the breach to persuade users to reveal confidential information.

The company emphasized that customers should remain cautious about requests for sensitive information received through communication channels.

"We will never ask you for your password or credit card information via email or phone," the company said.

Onamae.com is operated by GMO Internet, part of GMO Internet Group, and provides domain registration, web hosting, DNS, and other internet infrastructure services. Its Desktop Cloud byGMO platform supports remote server environments used by customers for various online operations.

The investigation remains ongoing, and GMO Internet said it would provide further updates as additional information becomes available. The company has not confirmed whether customer information was actually accessed or extracted by the attackers.