Hackers have successfully breached the infrastructure of **Onamae Desktop Cloud**, a popular virtual private server (VPS) provider in Japan, affecting a substantial number of its customers. The company, operated by **GMO Internet**, a member of the **GMO Internet Group**, confirmed on October 20 that an unauthorized third party installed "malicious programs" in customer server environments. ### Incident Details and Scope The intrusion led to malware deployment on up to 26,739 customer servers. Following detection, **Onamae Desktop Cloud** initiated a progressive shutdown of affected servers starting at 04:00 local time on October 21, 2026, to contain the breach. "We have confirmed that unauthorized access by a third party occurred against Onamae.com Desktop Cloud and that unauthorized programs were installed in some customers’ server environments," the company stated in its official announcement. ### Impact on Customers and Data Security **Onamae.com** is a major domain registrar and provider of various internet infrastructure services in Japan. Its Desktop Cloud byGMO service is notably marketed for stable automated trading, including continuous operation of **MetaTrader 4 (MT4)**, meaning a significant portion of affected users might be financial traders. The company's alert indicates that data stored on the compromised servers may have been exposed. However, **GMO Internet** has not yet confirmed any instances of data misuse or leakage. Crucially, payment information, such as credit card details, is reportedly unaffected, as it is stored on a separate infrastructure. ### Recommendations and Ongoing Response As the investigation unfolds, **GMO Internet** has committed to providing further updates. All Desktop Cloud plans are currently impacted by the service interruption, with no estimated date for restoration. Customers who stored sensitive information, such as passwords or API keys, on their servers are strongly advised to rotate these credentials immediately. The company also warned of an increased risk of phishing attempts and other unsolicited communications, as threat actors may try to leverage the incident to trick customers into disclosing sensitive data. "We will never ask you for your password or credit card information via email or phone," the company emphasized, urging vigilance against social engineering tactics.  ### The Broader Picture of Credential Compromise This incident underscores a critical vulnerability in the cybersecurity landscape: the impact of compromised credentials. Reports consistently show that once attackers gain valid credentials, their ability to navigate and act within a network significantly increases. Security professionals must continually evaluate their defenses, especially post-initial access, to prevent lateral movement and deeper incursions following a credential breach.