Onamae Desktop Cloud: the hosted desktop came with an extra tenant
Onamae Desktop Cloud confirms malware in customer servers and shuts down all plans for investigation
GMO confirms customer-data exfiltration alongside malware in Onamae Desktop Cloud. GMO began contacting customers about trading-loss claims on Nov 6. Migration is planned. IS6FX separately reports correcting verified unauthorized trades. The 26,739-server figure remains potential scope, not an infection count.
- Disclosed
- Oct 21, 2026
- Updated Nov 7, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Onamae Desktop Cloud customers; 26,739 servers potentially affected, not confirmed infected
- onamae
- In the wild
- Yes
- Vendor confirms unauthorized programs installed on customer servers
What happened
The vendor distinguishes possible exposure from proven misuse: the server total is a potential scope, not an infection count. Its dated notice does not identify the access method or attacker. L4 reflects confirmed compromise of customer environments at a hosting provider.
Update, October 28: The original notice’s lack of confirmed misuse is an early assessment. GMO now confirms that an apparent attacker published material claiming to concern the company and customers; it is verifying that material and will individually notify confirmed affected customers. Its October 27 tenth notice says ransomware activation had not been confirmed as of that update. That is not an all-clear. The new customer-PC isolation advice supplements the hosted-server shutdown and credential rotation, and does not establish that every potentially affected server or customer PC is infected.
Update, November 1: GMO’s October 24 fourth notice confirms that customer information was taken outside the service. That finding is separate from verification of the subsequently published material. On October 27, GMO announced further assistance conditional on confirming that a customer’s data was published; the leak-site takedown announced October 28 cannot retract copies already obtained.
IS6FX’s October 29 notice reports completed corrections and compensation for the unauthorized trades it verified. This is the broker’s account of its own response, not a statement that every Onamae customer has been reimbursed or that the original service has recovered. Investigation, individual data verification and GMO’s compensation procedures remain separate.
November 6 compensation update. GMO began contacting contracted customers individually about losses from unauthorized trades directly attributable to the incident. The company says the eligible-customer count and qualifying trades are still being checked, so it cannot estimate total compensation. Its November 13 results briefing is expected to cover claim progress and the outlook for calculating financial impact. Check notices sent to your registered address and verify them with GMO’s official support form. The public notice confirms outreach. It does not establish completed payments, a universal claim deadline or restoration of the old desktop environment.
Crime-scene timeline
Oct 20, 2026
Vendor confirms malicious programs in some customer environments
Oct 20, 19:00 UTC
Service shutdown begins across all plans
October 21 at 04:00 JST; the cited vendor notice is dated October 21.
Oct 24, 2026
GMO confirms data exfiltration and announces compensation and replacement-service plans
Oct 27, 2026
GMO confirms publication of purported data and expands precautions
Authenticity remains under review; the vendor has not confirmed ransomware activation.
Oct 27, 2026
GMO announces additional assistance conditional on confirmed publication of customer data
Oct 28, 2026
GMO reports takedown of the alleged leak-site domain and mirrors
This does not establish that copied data has been erased.
Oct 29, 2026
IS6FX reports compensation and trading-history corrections for verified unauthorized trades
The broker does not publish an affected-account count or total compensation amount.
Nov 6, 2026
GMO begins individual contact about unauthorized trading losses
Eligible-customer and transaction checks remain open. GMO expects to discuss application progress at its November 13 results briefing.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Onamae official noticePrimary26,739 potentially affected servers; malware confirmed in some environments; data misuse unconfirmed
- BleepingComputerReports the service-wide interruption and credential-rotation advice
- GMO eighth noticePrimaryCustomer-PC scanning, backup, disconnection and shutdown precautions.
- GMO tenth noticePrimaryPurported data published; authenticity under review; no ransomware attack confirmed as of this update; precautions reiterated.
- GMO fourth noticePrimaryConfirms exfiltration and describes compensation, replacement-service plans and verification safeguards.
- GMO twelfth noticePrimaryAdditional assistance depends on verified publication of customer information; customers will be contacted individually.
- GMO thirteenth noticePrimaryReports leak-site domain and mirror takedowns while continuing to monitor new sites.
- IS6FX compensation and security noticePrimaryReports compensation for verified unauthorized trades and explains password, session and evidence-preservation steps.
- GMO November 6 customer compensation noticePrimaryConfirms individual outreach about unauthorized trading losses and provides the official support channels.
- GMO November 6 compensation disclosurePrimaryConfirms outreach and outstanding checks of affected customers and trades. The next application-status update is planned for the November 13 results briefing.