GMO Internet, which runs Onamae.com, said an outside party broke into its Desktop Cloud service and planted malicious programs on some customers' servers. It confirmed this on 20 October 2026. From 4:00 on 21 October, it began switching customer servers off one by one. BleepingComputer reported that up to 26,739 servers were affected and that all Desktop Cloud plans are paused.
GMO says its investigation continues and it will share more later. It has given no restart date. BleepingComputer reported that data on the servers may have been exposed, but GMO has confirmed no misuse or leak. GMO says payment information, such as card details, was not affected because it is stored on separate infrastructure. The sources do not say how the attackers got in or how many servers carry malware. The 26,739 figure is a ceiling.
GMO told customers to change passwords stored on the servers, and any password reused elsewhere. Our inference: when the break-in is on the provider's side, the customer's own controls do not decide the outcome. Passwords kept on a hosted server are only as safe as that server. Leaders can ask: where do we store secrets, how will the provider alert us, and can we move our workloads?