By Hamza Faisal
One of Japan's biggest cloud providers has pulled the plug on an entire service. GMO Internet has shut down its Onamae Desktop Cloud after hackers broke into its infrastructure and installed malicious programs on customer servers — up to 26,739 server environments could be affected.
The company confirmed the intrusion on October 20, after a customer inquiry on October 19 tipped it off. It then began progressively shutting down customer servers at 4 a.m. local time on October 21. Every Desktop Cloud plan is impacted, and GMO has given no estimated date for bringing the service back online.
Onamae.com, operated by GMO Internet Group, is one of Japan's largest domain registrars and also provides web hosting, DNS, and other internet infrastructure services. The company said the breach may have exposed data stored on the impacted servers, though it has not confirmed any instance of information being misused or leaked so far.
Forex trading accounts hit
The damage goes beyond data exposure. Onamae Desktop Cloud is marketed specifically for automated FX trading — "ideal for stable FX automated trading, including continuous operation of MetaTrader 4" — and customer credentials stored on the compromised servers are now potentially in the wild.
AvaTrade Japan said hackers accessed customer accounts and executed unauthorized trades. OANDA Securities Japan temporarily delayed customer withdrawals on October 22 while running additional security checks, warning that customers who used its MetaTrader platforms through the affected VPS service may have had their account credentials exposed. GMO itself acknowledged customer reports of unauthorized operations on trading accounts, and cautioned that credentials stored in compromised environments may have been obtained and misused.
What 26,739 potentially exposed servers means
For customers, the guidance is blunt: anyone who stored passwords, API keys, or other secrets on their servers should rotate them immediately, because they may have been compromised. That includes passwords reused on other accounts, and broker logins for trading platforms. The company also warned of an increased risk of phishing emails exploiting the incident — and stressed that it will never ask for passwords or card details by email or phone.
GMO says payment information such as credit card details lives on separate infrastructure and is unaffected. It is working with a security firm and the police to investigate the intrusion, assess the damage, and prevent further misuse, and has set up a dedicated contact form and phone line for affected customers. Until the servers come back online — with no restart date in sight — trading bots, scheduled jobs, and unattended workloads running on the platform are dead in the water.
By Hamza Faisal
