Cyber incident briefing · Japan · Cloud hosting

GMO Desktop Cloud Breach: Unauthorized Program on Customer Servers and an ¥8 Billion Demand

Part 4 of 8 in Recent Cyberattacks: Fall 2026 Briefings

Confirmed by the organizationLast verified: November 1, 2026Reviewed by Ali Hassani, CISSP, C|CISO
Two engineers reviewing server status on a tablet in a data center

In October 2026, GMO Internet, the Japanese company behind the Onamae.com Desktop Cloud virtual-server service, found that a third party had installed an unauthorized program in some customers’ server environments (GMO notice, report 1 (Japanese)). GMO later confirmed customer information had been taken and that the attacker demanded about ¥8 billion, a demand GMO says it will not meet (GMO report 4 (Japanese); GMO report 7 (Japanese)). The case shows why organizations that rent cloud servers need their own plan for a provider-side incident.

OrganizationGMO Internet, Inc. (Onamae.com Desktop Cloud); later notices issued jointly with GMO Internet Group (GMO notice, report 1 (Japanese); GMO report 2 (Japanese))
WhenUnauthorized program confirmed October 20, 2026 (GMO notice, report 1 (Japanese))
Scope26,739 servers may be affected, according to GMO (GMO notice, report 1 (Japanese))
DataGMO confirmed customer information was taken out (GMO report 4 (Japanese)); it says it does not hold card payment data on these servers (GMO notice, report 1 (Japanese))
ExtortionAbout ¥8 billion demanded (roughly $50 million, per BleepingComputer’s conversion) (GMO report 7 (Japanese); BleepingComputer); GMO says it will not comply (GMO report 4 (Japanese))
RansomwareNot confirmed as of GMO’s October 27 update (GMO report 10 (Japanese))

Each item is linked to its source. Verification status reflects the strongest source available on the verification date.

What happened

  1. Oct 19. GMO begins investigating after a customer inquiry (GMO report 2 (Japanese)).
  2. Oct 20. GMO confirms an unauthorized program installed by a third party in some customers’ server environments and suspends sign-ups and the control panel (GMO notice, report 1 (Japanese); GMO report 2 (Japanese)).
  3. Oct 21. GMO shuts down servers on all plans in sequence and publishes its first notice (GMO notice, report 1 (Japanese)). GMO later said the threatening email arrived that day (GMO report 8 (Japanese)).
  4. Oct 22. GMO says it has consulted the police; customers report unauthorized activity in trading accounts whose logins were stored on the servers (GMO report 2 (Japanese)).
  5. Oct 24. GMO confirms customer information was taken and that the attacker demanded money and threatened publication; it announces compensation and a replacement service (GMO report 4 (Japanese)).
  6. Oct 26–27. GMO reports the attacker’s warning of data publication and a ransomware attack, tells customers to disconnect and power off their PCs, then confirms the attacker posted material it says may contain inaccurate content (GMO report 7 (Japanese); GMO report 8 (Japanese); GMO report 10 (Japanese)).

A related Japanese cloud incident

Weeks earlier, on October 7, 2026, IDC Frontier said a ransomware attack hit one region of its IDCF Cloud service, affecting 495 companies and local governments, and that it disconnected and shut down that region (IDC Frontier notice (Japanese)). No source reviewed links the two incidents.

What is still unknown

  • How the attacker got in. GMO says it is investigating the intrusion route with a security firm (GMO report 2 (Japanese)).
  • How many customers (as opposed to servers) were affected, and what data was published.
  • Who the attacker is. GMO’s notices do not name a group.

How organizations can reduce cloud-provider risk

Renting servers moves some security work to the provider, but not the responsibility for your data. General practices:

  1. Do not store passwords or trading, banking or admin logins in plain text on cloud servers or in saved tool settings.
  2. Keep backups that the provider’s platform cannot reach, and test restoring them somewhere else.
  3. Turn on MFA for the provider’s control panel and for every account on the servers.
  4. Have an exit plan: know how you would move a workload to another provider within days.
  5. Read your provider’s incident notices and act on them quickly; in this case, customers were asked to power off devices within hours.

How OC Security Audit can help

We review cloud and hosting setups, including where credentials are stored, backup isolation and recovery plans.

Ali Hassani, CISSP, C|CISO, is based in Irvine and works with organizations on-site across Southern California and remotely nationwide.

Schedule a consultationCall 949-777-5567

An audit shows where your controls are weak and what to fix first. No audit or service can guarantee that an organization will not be attacked; the goal is to lower the likelihood and the impact.

More in this series

PreviousRichmond Public Schools: network offlineFirstBinance hack: $6.3B from hot walletsNextPasskey-themed help-desk scams on Microsoft 365

See all briefings and their verification status in the recent cyberattacks and data breaches tracker.

Sources

  1. GMO Internet, Inc., October 21, 2026. https://www.onamae.com/news/article/11584
  2. GMO Internet Group, October 22, 2026. https://group.gmo/info/alert/20261022/
  3. GMO Internet Group, October 24, 2026. https://group.gmo/info/alert/20261024/
  4. GMO Internet Group, October 26, 2026. https://group.gmo/info/alert/2026102602/
  5. GMO Internet Group, October 27, 2026. https://group.gmo/info/alert/2026102703/
  6. BleepingComputer, October 27, 2026. https://bleepingcomputer.com/news/security/japans-gmo-urges-customers-to-shut-down-pcs-amid-ransomware-threat
  7. IDC Frontier, October 7, 2026. https://www.idcf.jp/news/topics/20261007002
  8. GMO Internet Group, October 27, 2026. https://group.gmo/info/alert/20261027/

About this briefing. This page summarizes publicly available information from the sources linked above, as of the verification date shown. OC Security Audit was not involved in responding to any incident described here and has no inside knowledge of them. Organization names are used only to identify the subjects of the cited public reports. Statements made by attackers are labeled as claims and are not treated as fact; details that the sources do not confirm are marked as unknown. Facts may change as investigations continue.

This content is for general educational purposes. It is not legal advice, a forensic conclusion or a finding about any organization’s security practices. See our editorial standards. To report an error, contact support@OCsecurityAudit.com and we will review it and publish a dated correction where needed.