Onamae.com Desktop Cloud: malicious program deployment and unauthorized trading account access
onamae-desktop-cloud-2026 · Disclosed 2026-10-21
GMOInternet's Onamae.com Desktop Cloud had malicious programs deployed, with potential impact on 26,739 servers. Trading account login information stored on servers was obtained and misused by a third party. The attacker demanded approximately 8 billion yen ransom and published some customer information, but the company refused to pay, establishing special compensation and a 150-million-yen bounty program.
Outcome: Confirmed breach
Entry path and evidence
- Reported fact
On October 20, malicious programs were confirmed to be deployed in some customers' server environments. The detailed entry path remains under investigation.
- Reported fact
The number of potentially affected servers is 26,739. Trading account login information stored on servers was obtained, and actual unauthorized use was reported.
- Reported fact
The company received an extortion demand for approximately 8 billion yen but stated it will never comply. On October 27, publication of some customer information was confirmed.
Timeline
Investigation initiated following customer inquiry. Malicious program deployment confirmed. [s2]
Began sequential shutdown of all plan servers from 4:00. First announcement published. Received 8-billion-yen ransom demand. [s1] [s3]
Consulted police. Second announcement published. [s2]
Decided on compensation payments, loss coverage, and alternative service provision. Requested government application of active cyber defense (4th report). [s3]
Confirmed attacker's publication of customer information. Announced special compensation (up to 3 million yen per publication) for affected customers. [s4]
Established 'GMO Cyber Crime Eradication Bounty' program totaling $1 million (~150 million yen) and began accepting information. [s4]
Reported response
- Reported fact
All servers were shut down to prevent further damage, and investigation of entry paths and impact scope is ongoing with security specialists.
[s2]セキュリティ専門会社とともに、侵入経路および影響範囲の調査 - Reported fact
Decided on 5,000-yen compensation for all customers, coverage of unauthorized trading losses, and alternative service provision. Special compensation (up to 3 million yen per publication) for customers whose information was published.
- Reported fact
Established a bounty program with a total cap of $1 million (~150 million yen) for information leading to perpetrator identification.
[s4]総額100万ドルを上限
Cause and mitigation hypotheses
Not assessed. Editorial hypotheses have not been added for this incident; this does not establish safety or a confirmed cause.
Evidence relevant to prevention
Insufficient evidence
Entry path and privilege controls at the time are unknown. Related rules inspect secure credential storage, multi-factor authentication, and session management.
Editorial assessment; not a determination of liability. [s2]
Unknowns and AI involvement
The reviewed primary sources do not establish attacker use of AI.
26,739 is the count of potentially affected servers, not actual breach count. Entry method, CVEs used, full recovery timing, and exact scope of published information remain unresolved.
Sources
[s1] GMOインターネット · Primary source
【重要】[お名前.com デスクトップクラウド]第三者による不正アクセスに関するお詫びとお知らせ（2026年10月21日 4:00時点） ↗Published 2026-10-21 · Reviewed 2026-11-02
[s2] GMOインターネットグループ · Primary source
【重要】「お名前.com デスクトップクラウド」への不正アクセスに関するお詫びとお知らせ（第3報） ↗Published 2026-10-23 · Reviewed 2026-11-02
[s3] GMOインターネット · Primary source
「お名前.com デスクトップクラウド」への不正アクセスに関するお客様へのご案内 ↗Published 2026-10-30 · Reviewed 2026-11-02
[s4] GMOインターネットグループ · Primary source
【重要】「お名前.com デスクトップクラウド」への不正アクセスに関する現在の対応について（第12報） ↗Published 2026-10-27 · Reviewed 2026-11-02