Hackers broke into the infrastructure of Onamae Desktop Cloud, a Japanese VPS provider run by GMO Internet, and installed malicious programs on customer servers. The company confirmed the intrusion on October 20, 2026, said up to 26,739 servers may be affected, and shut down every Desktop Cloud plan starting at 4:00 a.m. local time on October 21. Payment data was not hit, but anything else stored on the affected servers may have been viewed. The fallout is already reaching beyond the servers themselves: on October 22, brokerage OANDA Japan delayed some customer withdrawals as a precaution because MetaTrader login credentials stored on the rented servers could have been seen by the attackers.
What happened: the timeline so far
GMO Internet operates Onamae.com, one of Japan’s largest domain registrars and a provider of hosting, DNS, and other internet infrastructure. Its Desktop Cloud byGMO service sells virtual private servers that are explicitly marketed for stable, always-on automated FX trading, including continuous operation of MetaTrader 4. That positioning is exactly why this breach matters so much: thousands of customers keep live trading setups, login credentials, and automated strategies on these servers.
Here is how the incident unfolded:
- October 20, 2026: GMO confirmed that an unauthorized third party had gained access to Onamae Desktop Cloud and installed unauthorized programs in some customers’ server environments.
- October 21, 4:00 a.m. local time: The company began progressively shutting down customer servers to contain the threat. The suspension covers all Desktop Cloud plans, not just the affected ones.
- October 22: OANDA Securities Japan temporarily delayed processing some customer withdrawals while it ran security checks on possibly exposed MetaTrader credentials.
- Now: The service remains suspended with no announced restart date, and GMO says it will publish updates as its investigation progresses.
How many servers are affected
GMO says up to 26,739 servers may be affected. That number needs to be read carefully. It is the count of potentially exposed server environments, not a confirmed tally of compromised machines. Still, for a VPS service aimed at retail traders, the number is striking. It means the attackers did not pick off a handful of customers one by one. They got into the underlying infrastructure and deployed their malicious programs at scale, across thousands of separate customer environments.
The company has not said how the attackers got in. No vulnerability, no exploited product, and no initial access vector has been named publicly. That is one of the biggest open questions in the investigation, and the answer will decide whether other GMO services need to be worried.
Why FX traders took the hardest hit
Desktop Cloud byGMO is popular specifically because it is optimized for running MetaTrader 4 around the clock. Automated trading systems, called expert advisors, need to stay online at all hours, and many retail FX traders in Japan rent a VPS so their strategies keep running even when their own computer is off.
That convenience comes with a risk that is now on full display. To trade, these servers hold MT4 login credentials, API keys, and sometimes account details. When the host itself is compromised, everything stored on the virtual machines is potentially in the attackers’ hands. GMO has explicitly warned customers that information stored on the affected servers may have been viewed, and told them to rotate any secrets, passwords, and identification details stored on the machines as soon as possible.
It also warned customers who reuse passwords across services to change those too. If an attacker lifted a password from a trading server and the customer uses the same one for email or a bank account, the exposure spreads fast.
OANDA Japan delays withdrawals
The first visible real-world impact arrived on October 22. OANDA Securities Japan held back some customer withdrawals while it carried out security checks, concerned that MetaTrader login credentials stored on the compromised Onamae servers could have been viewed by an unauthorized party.
The delay was narrow and precautionary. According to reporting on the move, requests submitted before 11 a.m. on Thursday were held for checks, with processing scheduled to resume from 11 a.m. on Friday, October 23, and affected funds expected to reach customers’ registered bank accounts by around 4 p.m. that day. There is no evidence that OANDA’s own systems were breached or that customer deposits were stolen. The company treated the situation as a credentials risk stemming from a third-party host, not a failure of its own platform.
Even so, the episode is a preview of how cloud supply chain attacks spill over. A breach at a hosting provider becomes a banking delay for people who never signed up with the attackers’ actual target. Incidents like this one and the Revolut breach earlier this month show how fast financial exposure travels when infrastructure fails.
What GMO has confirmed, and what it has not
Confirmed:
- Unauthorized access by a third party against Onamae.com Desktop Cloud.
- Malicious programs installed in some customers’ server environments.
- Up to 26,739 servers potentially affected.
- All Desktop Cloud plans suspended from 4 a.m. on October 21, with no restart date.
- Data stored on impacted servers may have been viewed.
- Payment information, including credit card details, is held on separate infrastructure and is not affected.
Not confirmed:
- How the attackers gained access in the first place.
- Whether any customer data was actually misused or leaked.
- When the service will be restored.
GMO also warned customers about a likely second wave: phishing. Attackers routinely follow big infrastructure breaches with emails and calls impersonating the provider, trying to harvest credentials from people already anxious about the incident. The company said plainly that it will never ask for passwords or credit card information by email or phone.
What affected customers should do right now
If you used Onamae Desktop Cloud, treat everything stored on your virtual server as potentially exposed until proven otherwise. The safe steps:
- Rotate every secret on the server. Change MT4 and trading account passwords, API keys, and any tokens stored on the machine. Do this from a clean device, not from the suspended server.
- Change reused passwords. If the same password was used on email, banking, or other accounts, change those as well.
- Review trading and financial accounts. Look for unrecognized login sessions, changed settings, or transactions you did not make.
- Turn on two-factor authentication everywhere it is offered, especially on trading and email accounts.
- Be skeptical of outage-related messages. Expect phishing emails pretending to be GMO or your broker. Verify any request through official sites and apps, not through links in messages.
- Watch your broker. If you trade through OANDA Japan or another broker and notice delayed withdrawals or odd account behavior, contact support directly.
If your expert advisors stopped running, do not rush to restore them on a new server until you have confirmed that your credentials are clean. An automated strategy running on compromised credentials can do damage while you sleep.
Why this matters beyond Japan
Attacks on the providers themselves keep getting bigger. The supply chain lesson here mirrors what happened in the Tensorlake npm compromise, where one trusted distribution point became the attacker’s vehicle into thousands of downstream environments. When the cloud you rent gets owned, your perimeter no longer matters. The Onamae breach is the same pattern applied to infrastructure instead of software: compromise the platform once, and you reach every customer on it.
There is also a timing angle worth noting. October 2026 has been a brutal month for Japanese corporate security, with several major incidents reported in quick succession. The Warlock ransomware takeover showed how one unpatched server can turn into a nine-day network occupation; the Onamae case shows the inverse, where the infrastructure provider itself becomes the single point of failure for thousands of businesses at once.
For traders and small businesses that depend on rented servers, the practical takeaway is simple. Keep secrets in a password manager rather than in plain text on the VPS, use unique credentials for every service, enable two-factor authentication, and have a backup plan for when the host goes dark. When the outage is the provider’s own security decision, there is no support ticket that brings your server back online. There is only the recovery plan you made before it happened.
FAQ: Onamae Desktop Cloud hack
Were customer passwords actually stolen in the Onamae hack?
GMO has not confirmed any data theft or misuse. It says information stored on affected servers may have been viewed. Customers should assume the worst case and rotate everything, but there is currently no evidence of leaked credentials being used.
Is my credit card information safe?
Yes, according to GMO. Payment information is stored on separate infrastructure that was not part of the compromised Desktop Cloud environment.
When will Onamae Desktop Cloud be back online?
No date has been announced. All Desktop Cloud plans were suspended from 4 a.m. local time on October 21, 2026, and GMO says it will share updates as the investigation progresses.
Should I change my MetaTrader password?
Yes. If your MT4 credentials or any trading login were stored on an Onamae Desktop Cloud server, change them now from a clean device, and change them anywhere else the same password was reused.
Can I still run my automated trading strategies?
Not on Onamae Desktop Cloud while it is suspended. If you move to another VPS, use fresh credentials and verify your trading accounts show no unauthorized activity before restarting automation.
What about OANDA Japan withdrawals?
OANDA Japan briefly delayed some withdrawals on October 22 as a precaution. Processing was scheduled to resume from 11 a.m. on October 23, with affected funds expected to reach bank accounts by around 4 p.m. The delay was limited to the affected requests, not a full suspension.
How do I spot phishing related to this breach?
Be wary of emails or calls claiming to be from GMO or your broker asking for passwords or card details. GMO says it will never request that information by email or phone. Go to official websites directly instead of clicking links in messages.
Did the Pentagon breach teach anything similar?
Different sector, same lesson. The Pentagon data breach earlier this month also exposed how a single trusted system’s failure can put thousands of individuals at risk, and why fast credential rotation is the first move after any exposure.