- GMO Internet found malicious programs in some customers' server environments and began stopping Onamae.com Desktop Cloud servers on October 21, 2026. The notice gives no restart date.
- An unnamed alert cited by Infosecurity Magazine claimed some information may have been accessed and up to 26,739 servers affected. GMO's notice confirms neither.
- Leaders should ask what a vendor shutdown would stop, where logins are saved on rented machines, and who decides when a service is switched off.
When your staff's computers run on a vendor's servers, your ability to work rests on the vendor's security as much as on your own. The incident at Japan's GMO Internet shows that dependence in practice. It also shows how much a notice can leave unsaid.
What GMO Internet's notice says
GMO Internet runs Onamae.com Desktop Cloud. Its customer notice says a third party gained unauthorized access. The company found malicious programs installed in some customers' server environments. It dates that finding to October 20, 2026.
To stop the harm spreading, GMO began shutting down customers' servers in stages from 4:00 on October 21. The notice gives no restart date. It says the investigation continues.
The notice asks customers to change any logins stored or used on those servers, and any password reused elsewhere. It warns of phishing messages that exploit the incident. GMO says it does not ask customers for passwords or card details by email or phone.
What Infosecurity Magazine adds
Infosecurity Magazine says the service runs on a network of tens of thousands of servers operated by GMO. It says foreign-exchange traders favour it. The magazine cites an unnamed security alert. That alert claimed some information may have been accessed and put the possible reach at up to 26,739 servers. GMO's notice confirms neither point and gives no server count.
The magazine also reports an extortion email sent on October 21. It asked for about eight billion yen, or $50.7 million. GMO refused to pay, the article says. The attackers then said they would deploy ransomware at noon on October 27. Ransomware locks files until a payment is made.
Some reports, the article adds, suggest attackers may have reached trading accounts and made unauthorized transactions. This is unconfirmed. GMO's notice does not mention it.
How the sequence reads, and what is unclear
GMO confirmed the malicious programs on October 20. Its staged shutdown began on October 21, the day the extortion email was sent. The ransomware deadline was October 27. The sources do not give the time of the email. They do not link the shutdown to the extortion demand, so no cause should be read into the order.
The coverage also describes advice that sits oddly beside a hosted service. GMO reportedly told customers to scan their devices, back up data, disconnect their PCs from the internet and power them off. It also asked customers to ship PCs to its security team. The sources do not explain how this fits a hosted model.
The October 27 update needs careful reading. As of 11:59 that day, GMO said no malware had been found in the devices analyzed so far. It added that analysis was ongoing and that not all customer devices were confirmed secure. That result covers only the machines examined.
The sources do not say how the attackers got in. They do not say whether the affected environments shared infrastructure. GMO's notice does not say whether data was taken. The alert's claim of access remains unconfirmed.
How a hosted desktop works
This is general explanation, not a finding about GMO. A hosted desktop is a computer that runs in the vendor's data centre. Staff reach it over the internet from their own screen. The operating system, the files and any saved logins all live on the vendor's servers.
That design has two consequences. First, the vendor holds the power switch for every customer's machine. It can halt them all at once, and customers cannot override it. Second, a password saved on a remote machine sits wherever that machine sits. If the vendor's side is compromised, those saved logins could be exposed too.
Here, the provider stopped customers' servers and gave no restart date. GMO's request to change stored credentials shows why saved logins matter. The sources do not say what customers actually stored.
Phillip Wylie of Suzu Labs told Infosecurity Magazine that attackers need not deploy ransomware to cause serious damage. Stolen information, compromised accounts and threats of public release already give them leverage. He added that limiting what attackers can do after getting in matters as much as stopping the first break-in.
Questions to put to your team
List every service where staff do their daily work on a vendor's servers. For each, ask what your business could not do if the vendor stopped it for a week.
Ask where passwords and access tokens are saved on those machines. If the vendor asked you to change all of them tomorrow, how long would it take?
Check your contract. Who decides to shut the service down? How quickly are you told? What do you receive while it is down? How would staff work without it?
Prepare staff for fake messages that claim to come from the vendor. GMO warned of exactly that.
This is one provider and one incident. The useful lesson is narrow: know what you would do on the day a service you depend on is switched off.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: GMO Internet.
