Hackers planted malware on up to 26,739 customer servers at Japan’s Onamae Desktop Cloud

Up to 26,739 customer servers at Onamae.com Desktop Cloud, a virtual server service in Japan run by GMO Internet, may have been hit after an unauthorized third party got into the platform and installed malicious programs. The operator began suspending servers on every plan at 4:00 a.m. Japan time on Oct. 21, and had given no restart date as of its notice.

The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.

Get TLDR →

We may earn a commission if you sign up.

The figure is a ceiling rather than a confirmed count of infections: GMO says the servers may be affected, and it has not said how many actually carried malware. The intrusion matters most to traders who rented the service to run automated foreign-exchange software around the clock.

What GMO Internet has confirmed so far

The operator’s security notice says unauthorized programs were found on some customers’ server environments on Oct. 20, that a third party had accessed Onamae.com Desktop Cloud, and that information stored on the servers may have been viewed. It puts the number of servers that may be affected at 26,739 and says the suspension covers every Desktop Cloud plan.

As of that notice, no leak of customers’ personal information held by the company had been confirmed, and no misuse of viewed data had been found. The company says it does not hold payment data such as credit card details on these systems. The investigation is continuing, and GMO promised updates once details are confirmed. Phone support runs on weekdays from 10:00 to 18:00, and the notice warns that response times may be longer because of heavy inquiry volume.

BleepingComputer’s report on the incident notes that its headline rounds the figure to 27,000 and that the company has not named the malware family, the way in, or the group behind it. The same gap exists in the operator’s own notice, which describes only a third party and unauthorized programs.

Why a trading server is a valuable target

Desktop Cloud is marketed to foreign-exchange traders. BleepingComputer quotes the advertising line describing it as ideal for stable FX automated trading, including continuous operation of MetaTrader 4. A server like that can hold the very thing an intruder wants, such as saved logins for brokerage accounts and trading platforms, and the operator’s own warning about stored credentials points the same way.

That context explains the operator’s advice, which goes beyond a routine password reset. Customers are told to change promptly any IDs and passwords stored or used on the affected server, and to change the same passwords wherever else they are reused. They should also expect phishing built around the incident, and the company says it will never ask for a password or credit card details by email or phone.

Reports of trading-account fallout

Outside commentary has pushed the picture further than the first notice. Japanese technology site @SOHO’s account of the timeline says GMO announced an emergency maintenance window on the evening of Oct. 20, revised it at 3:48 a.m. on Oct. 21 to add server suspension, and then published its apology and notice at 4:00 a.m. It stresses that 26,739 counts servers, not people, and does not prove that every one was accessed.

A later write-up from SmartScope on the second report, dated Oct. 22, says the operator then warned that login information for trading accounts stored on servers may have been obtained and misused, that customers reported unauthorized activity in their trading accounts, and that the operator had consulted the police. That summary also says nothing had been disclosed about refunds, fee reductions, or compensation for trading losses, nor about how open positions are handled during the suspension. These points come from secondary reporting and were not confirmed against the operator’s page on Oct. 23.

For customers, SmartScope lists steps that fit the operator’s guidance: change broker and trading-platform passwords from a different device, sign out existing sessions, review trade history and balances, contact the broker about anything unfamiliar, and switch on two-factor authentication where the broker offers it.

A familiar brand with an earlier incident

GMO Internet is described by BleepingComputer as one of Japan’s largest domain registrars, and the Onamae.com brand has been through a security incident before. In October 2013, ScanNetSecurity reported unauthorized access to some Onamae.com services in connection with the BIGLOBE dynamic DNS service, likely through an Apache Struts2 vulnerability, with server information possibly viewed. That case involved a different service and a publicly known software flaw, so it offers no direct explanation for the Desktop Cloud intrusion.

The current case has fewer known facts than unknowns. The operator has not said how the attackers entered, how long they were inside, how many of the 26,739 servers actually ran their code, or when service will return. Customers who kept anything valuable on those machines are in the position of assuming exposure while the investigation catches up, which is why the operator itself tells them to treat stored credentials as compromised.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

The day in tech, in one email: Get TLDR →

We may earn a commission if you sign up.