GMO Internet shuts down all Onamae.com Desktop Cloud plans after unauthorised programs are found on customer servers, with up to 26,739 servers possibly affected

TLDR

• GMO Internet says a third party accessed Onamae.com Desktop Cloud and installed unauthorised programs in some customers' server environments.¹²
• Up to 26,739 servers may be affected, and all plans have been shut down with no restart date.²³
• GMO has not confirmed any leak or misuse and urges customers to change credentials stored on their servers.²³

GMO Internet said on 21 October that unauthorised access by a third party had occurred on Onamae.com Desktop Cloud and that unauthorised programs had been installed in the server environments of some customers.¹² The notice on GMO Internet's site refers customers to the Onamae.com service notices for details and says further findings from the investigation will be posted there.¹ ITmedia NEWS describes the service as a virtual private server for running automated foreign exchange trading software such as MetaTrader 4 and 5, priced from 2,640 yen a month, and says the company cites more than 200,000 cumulative contracts.²

ITmedia NEWS reports that the number of servers that may be affected is 26,739, that the company confirmed the unauthorised programs on 20 October, and that information stored on the servers may have been viewed.² BleepingComputer, which cites the company's alert, goes further and says the attackers installed malware on up to 26,739 customers' servers.³ Both say the company began shutting down servers in stages from 04:00 local time on 21 October to prevent the damage spreading, and that all plans are affected, with no restart date given.²³

GMO Internet has not confirmed any leak of customers' personal information or misuse of viewed data, according to ITmedia NEWS.² On payment data, ITmedia NEWS says the company does not hold payment information including credit card details, while BleepingComputer says the company states that such information is stored on separate infrastructure and is not affected.²³ The company asks customers who store or use IDs, passwords or other credentials on their servers to change them promptly, including any reused on other services.²³ BleepingComputer adds that the company warns of a higher risk of phishing messages and says it will never ask for passwords or card details by email or phone, and ITmedia NEWS says inquiries are heavily congested and replies may be slow.²³ None of the three sources describes how the intruder gained access or names an actor.

Why it matters: the shutdown of an entire hosted-server product used for automated trading shows how a provider-side compromise can reach thousands of customer machines at once, and customers who kept credentials on those servers have to treat them as exposed.²³