GMO Internet's Onamae Desktop Cloud Hit by Intrusion; Data Stolen and Ransomware Threat Prompts Shutdown Advice

What happened

On October 20 2026 GMO Internet detected an intrusion into its Onamae Desktop Cloud VPS platform. The attackers likely installed malware on up to 26,739 customer servers, exfiltrated internal and customer data, and published portions online while demanding a ¥8 billion ransom. GMO responded by shutting down the affected servers, reducing service availability, and instructing customers to disconnect, power‑off, and unplug their PCs. The company confirmed that payment information was not exposed, but MetaTrader 4/5 trading‑account credentials may have been compromised. GMO offered ¥5,000 compensation per affected customer and is working with Trend Micro to remediate the incident.

Why it matters for trust and compliance

• The breach tests the effectiveness of incident‑response controls and the ability to produce defensible evidence of containment for audit purposes.
• Demonstrate incident‑response evidence (shutdown, isolation, forensic scanning) to satisfy audit requirements.
• Validate credential‑management and MFA controls to reduce future credential‑compromise risk.

Who is affected

Recommended actions

1. Review and test incident‑response playbooks, ensuring documented shutdown and isolation steps are in place.
2. Audit credential‑management processes, enforce MFA for admin accounts, and require immediate password resets for any exposed credentials.