Skip to content
Onamae Desktop Cloud Service Halted After Malware Attack on 26,739 Servers

Onamae Desktop Cloud Service Halted After Malware Attack on 26,739 Servers

First seen 22 Oct 2026, 17:46 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 18:44 UTC
  • •Onamae Desktop Cloud experienced a significant breach affecting over 26,000 servers.
  • •Malware was installed on customer servers, prompting a complete service shutdown.
  • •Customers are advised to change passwords and remain vigilant against phishing attempts.

On October 20, 2026, Onamae Desktop Cloud, a Japanese VPS provider, confirmed that hackers compromised its infrastructure, installing malware on approximately 26,739 customer servers. The company began shutting down affected servers at 4 a.m. local time on October 21, 2026, and has not provided an estimated date for service restoration. While the breach may have exposed customer data, Onamae stated that payment information remains secure as it is stored separately. Customers are advised to rotate passwords stored on their servers due to potential compromise. The company also warned of increased phishing risks following the incident. Onamae Desktop Cloud is operated by GMO Internet, a major internet infrastructure provider in Japan.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-20
Breach confirmed by Onamae
Onamae Desktop Cloud announced unauthorized access and malware installation on customer servers.
Bleepingcomputer
2026-10-21
Service shutdown initiated
The company began shutting down affected servers at 4 a.m. local time to mitigate the breach.
Teiss

More articles in this cluster (2)

Following this threat?

Track GMO Internet in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 4

Common questions

How many servers were affected?
Approximately 26,739 customer servers were compromised by the malware.
What should customers do now?
Customers are advised to rotate any passwords stored on their servers and be cautious of phishing attempts.
Is payment information at risk?
No, payment information is stored on separate infrastructure and was not affected by the breach.