Security Guides
Unauthorized Access to Onamae.com Desktop Cloud (GMO Internet) (26,739 Servers Possibly Affected): Trading Account Logins May Have Been Misused, and What FX and Securities Traders Should Do Today
GMO Internet says a malicious program was placed on some servers of Onamae.com Desktop Cloud, a VPS for FX auto-trading. Trading account logins saved in trading tools such as MT4/MT5 may have been taken and misused, its second notice says. What users should do today.
For: FX and securities traders who ran MT4/MT5 or other trading tools on Onamae.com Desktop Cloud. This article is based on GMO Internet, Inc.'s official notices and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 23, 2026Not yet known
- The intrusion route (the company is investigating with a security firm)
- What kind of malicious program was placed and what it did
- How many accounts suffered unauthorized operations, and the amounts involved
- Whether customers will be contacted individually
- When the service will restart, and how servers will be handled after the restart
- How fees for the stoppage will be handled
- Measures to prevent a recurrence
The company says the restart date is undecided and will be announced once safety has been confirmed, and that it will publish information as it becomes known. As of October 23, there was no third notice in the Onamae.com news list.
What Desktop Cloud users should do today
Steps 1 to 3 and 5 are what the company asks for in its second notice. The phishing warning in step 6 is also the company's (the example wording is ours). Step 4 is this site's general advice. How to change passwords and set up two-step authentication differs between securities and FX companies, so follow your provider's official instructions.
Change your trading tool and trading account passwords from your own computer or phone
The company asks customers to "change immediately" the passwords and other credentials of trading tools from securities and FX companies (MT4/MT5 and others) and of their trading accounts. It asks that the change be made from a device other than the service's servers. The servers of all plans are stopped, so do this from your home computer or phone.
Go to your broker's site from a bookmark or its official app, not from a link in an email or text message. Make the new password long and not used for any other service. How to create and store one is covered in Are password managers safe?.
After changing them, log off to end any signed-in sessions
The company asks customers to log off (end the session) after changing the password. A session that is already signed in can sometimes still be used after the password changes. If your broker's site has a list of signed-in devices or a "sign out of all devices" option, use it too.
Check your trading history and balance, and report trades you did not make to your broker
The company asks customers to check the trading history and balance of their trading accounts, and to contact their trading provider if they see trades they did not make. If you used accounts with several securities or FX companies on the server, check every one of them.
Saving screenshots of your trading history before you call makes the situation easier to explain. The company's notices do not say how losses will be handled, and this may differ between providers, so ask when you call. If you have suffered losses, you can also consult the cybercrime consultation desk of your prefectural police (in Japanese).
Check open positions and orders, and your withdrawal account and contact details
While the servers are stopped, the auto-trading programs (EAs) you ran on them are stopped too. Use your broker's official app or website to check whether positions you planned to close, or orders you left in place, are still open, and decide manually where needed.
At the same time, check that your withdrawal bank account, registered email address and phone number have not been changed to ones you do not recognise. Changes there can lead to unauthorized withdrawals or to notices going to someone else. How to read sign-in history is covered in how to check whether your account has been accessed.
Set up two-step authentication, and change other passwords saved on the server
The company asks customers to set up two-step authentication or similar if their trading provider offers it. It also asks customers who kept credentials (IDs, passwords and so on) on the server to change them promptly, and to change the same password on any other service where it was used.
Examples include email or online banking passwords saved in the server's browser, and IDs written in a text file. How to find reused passwords is in how to check if your password was leaked, and how to choose a sign-in method is in choosing multi-factor authentication.
Watch for emails, calls and websites using this incident
The company warns about phishing emails, suspicious contacts and suspicious websites that take advantage of this incident, and says it never asks for passwords or credit card details by email or phone. After an incident like this, fake messages are likely, with wording such as (our examples) "compensation procedure" or "identity check before your server restarts", leading to pages made to look like a login screen. See what phishing is for how to tell them apart.
What happened (per GMO Internet)
The following is based on GMO Internet, Inc.'s first notice of October 21, 2026 (content as of 04:00) and its second notice of October 22. On the company's site, Onamae.com Desktop Cloud is described as a "VPS dedicated to FX auto-trading" that supports MT4/MT5. According to the company's specification page, the operating system is Windows Server 2019.
October 19, 2026
After an inquiry from a customer, the company began investigating (second notice).October 20
The company found that a third party had placed a malicious program in some customers' server environments. New sign-ups and the control panel were stopped (second notice). On the company's maintenance page, this was announced as emergency maintenance from around 21:00.October 21, 04:00
To prevent further damage, servers of all plans were stopped one after another. First notice published.From October 21
Customers reported unauthorized operations on their trading accounts. The company shared the situation with the businesses concerned and asked them to help, for example by informing customers.October 22
The company consulted the police. Second notice published.As of October 23
No third notice. The servers remain stopped.
- Service
- Onamae.com Desktop Cloud (all plans)
- What happened
- Unauthorized third-party access; a malicious program was placed in some customers' server environments
- Scope
- 26,739 servers may be affected
- Information that may be affected
- Information saved on the servers (including trading account login details saved in trading tools)
- Misuse
- Trading account login details and other information saved on the servers may have been obtained by a third party and misused, the company found. Customers have reported unauthorized operations by a third party on their trading accounts
- Information not concerned
- Payment information (including credit card details) is not held on the service's servers
- Cause
- Not disclosed. The intrusion route and scope are being investigated with a security firm
- Company response
- All plans remain stopped. The company is working with the businesses concerned to confirm the damage and stop it spreading. It consulted the police on October 22
- Warning
- Beware of phishing emails, suspicious contacts and suspicious websites using this incident. The company never asks for passwords or credit card details by email or phone
- Contact
- Inquiry form (help.onamae.com/contact/), phone 03-5456-2560 (the first notice gives hours of 10:00–18:00 on weekdays, Japan time). Replies may take time because of the volume of inquiries, the company says
What is known and what is not
This is the state as of October 23, 2026. When a follow-up notice comes out, the status column will be updated.
| Item | What the notices say | Status |
|---|---|---|
| Malicious program placed | In some customers' server environments; found on October 20 | Confirmed (company) |
| Number of servers that may be affected | 26,739 | Confirmed (company) |
| Information saved on the servers | Listed as information that may be affected | Affected (company) |
| Trading account login details taken and misused | May have been obtained by a third party and misused | Possible (company) |
| Reports of unauthorized operations on trading accounts | Reports received from customers | Confirmed (company) |
| Number of accounts with unauthorized operations, amounts | Not stated | Not stated |
| Customers' personal data held by the company | As of the first notice, no leak had been confirmed (not mentioned in the second notice) | Not confirmed (company, as of the first notice) |
| Payment information (including credit card details) | Not held on the service's servers | Not included (company) |
| Intrusion route and cause | Being investigated with a security firm | Under investigation |
| Type and function of the malicious program | Not stated | Not stated |
| Individual notification | Not stated | Not stated |
| Service restart | Undecided; to be announced once safety is confirmed | Not set (company) |
| Police | Consulted on October 22 | Confirmed (company) |
Reading note: the first and second notices describe misuse differently
The first notice (October 21) said that no misuse of the information viewed had been confirmed. The second notice (October 22) says trading account login details and other information may have been misused. If you only read the first notice, check the "requests to customers" in the second. The word "may" in the second notice does not mean information was taken from every server. Which servers were actually hit has not been disclosed, so it is safest for every user to act.
What is often kept on a trading server
In general, an auto-trading VPS holds the following in addition to the trading tools. This does not mean these were read or used in this incident. The list is to help users work out what to change.
Account numbers and passwords saved in trading tools
Login details saved in MT4/MT5 and similar tools
↓→
Change them from a device other than the server and log off; check history and balance
Passwords saved in the server's browser
Broker web pages, email, online banking and so on
↓→
Change all of them, including anywhere the same password was reused
IDs and passwords written in notes or files
Lists of several accounts, accounts on sites where you bought EAs
↓→
List what was written there and change all of it
In many cases, trading account login details are enough on their own to sign in and trade. Even while the servers are stopped, details that were already taken can still be used, so the risk remains until you change the password. That is why step 1 stresses changing it promptly from a device other than the server.
As general guidance on unauthorized access to online brokerage services, Japan's Financial Services Agency asks investors to turn on multi-factor authentication for sign-in, trading and withdrawals, to use notification services, and not to reuse passwords (FSA caution, in Japanese). It is not a statement about this incident, but it is a useful reference for protecting a trading account.
What auto-traders on a VPS can review: from the disclosed facts
The company has not disclosed the cause, so this section does not say how the incident could have been prevented, and it does not assess the company's response. It looks only at one disclosed fact, that the information possibly affected included trading account login details saved in trading tools, and at what users can review themselves.
Keep only what the trading tools need on the server
An auto-trading server has to hold the details its trading tools use to sign in to your accounts. If you keep nothing else there (no email or online banking passwords, no notes listing your accounts), you will have less to change if the server is compromised. Not saving passwords in the server's browser is one way to do this.
On each trading account, protect withdrawals and changes to registered details
As long as trading tool logins sit on a server, they cannot always be fully protected. So, on the account side, turn on extra checks (multi-factor authentication) for withdrawals, changes to the withdrawal account and changes to the registered email address, if your provider offers them. Which actions get extra checks differs between securities and FX companies, so check your provider's guidance.
Receive sign-in and trade notifications on your own phone
If your securities or FX company offers notifications for sign-ins, executed trades and withdrawals, have them sent to your own phone. Auto-traders often do not look at the server screen every day, so having a way to notice unfamiliar activity quickly, separate from the server, helps.
How to handle "credentials stored on a server" is also covered for website owners in the rental hosting incident unauthorized access to ConoHa WING. They are separate incidents, and this does not mean they share a cause.
Sources (public record)
The facts in this article come from the public information below. We have not guessed at undisclosed access routes or techniques.
- GMO Internet, Inc., "[Important] [Onamae.com Desktop Cloud] Apology and notice regarding unauthorized third-party access (as of 04:00, October 21, 2026)" (October 21, 2026; in Japanese) — onamae.com
- GMO Internet, Inc., "[Important] Apology and notice regarding unauthorized access to Onamae.com Desktop Cloud (second notice)" (October 22, 2026; in Japanese) — onamae.com
- Onamae.com, "[Urgent] [Desktop Cloud] System maintenance (updated 2026/10/21)" (checked October 23; in Japanese) — onamae.com
- Onamae.com Desktop Cloud, "Pricing and specifications" (operating system; checked October 23; in Japanese) — onamae-desktop.com
- Onamae.com news list (checked October 23; no third notice; in Japanese) — onamae.com
- Financial Services Agency, "Beware of unauthorized access and unauthorized trading on online trading services" (general guidance, not a statement about this incident; in Japanese) — fsa.go.jp
Update history
2026-10-23: First version, based on GMO Internet's first notice of October 21 (as of 04:00), its second notice of October 22, and the news list (checked October 23). The company says it will publish information as it becomes known, and this article will be updated when it does.
Read next
- Checking sign-ins: how to check whether your account has been accessed (sign-in history and signed-in devices)
- Passwords: how to check if your password was leaked / Are password managers safe?
- Stronger sign-in: choosing multi-factor authentication / what two-factor authentication is
- Trends: how Japan's 2026 breaches got in: legitimate credentials more often than vulnerabilities
- Another incident at a different service of the same company: unauthorized access to some ConoHa WING (GMO Internet) servers (426 accounts)
- Terms: what phishing is / what malware is
- Other 2026 incidents: data breaches and cyberattacks in 2026 (Japan and worldwide)
FAQ
QWhat happened in the Onamae.com Desktop Cloud unauthorized access?
According to GMO Internet, Inc., on October 20, 2026 it found that a third party had placed a malicious program in some customers' server environments. 26,739 servers may be affected. In its second notice of October 22, the company said trading account login details and other information saved on the servers may have been obtained by a third party and misused. Customers have reported unauthorized operations by a third party on their trading accounts.
QAm I affected?
The company puts the number of possibly affected servers at 26,739 and names the affected service as 'all plans'. As of October 23, its notices do not say whether it will contact customers individually. If you ran trading tools on this service, assume you are affected and take the steps the company asks for: change your passwords, check your trading history, and set up two-step authentication.
QAre my passwords and credit card details safe?
The company says it does not hold customers' payment information (including credit card details) on the service's servers. However, the information that may be affected is 'information saved on the servers', which includes trading account login details saved in trading tools. Change the passwords of your trading tools and trading accounts, any other IDs and passwords saved on the server, and any other service where you used the same password.
QWhat caused it?
As of October 23 it has not been disclosed. The company says it is investigating the intrusion route and the scope with a security firm. What the malicious program did has not been disclosed either. The company says it will publish information as it becomes known.
QWhat if I get an email or call claiming to be Onamae.com or GMO Internet?
The company warns about phishing emails, suspicious contacts and suspicious websites that take advantage of this incident, and says it never asks customers for passwords or credit card details by email or phone. Treat any message asking for a password or card details as fake, do not use links in emails or text messages, and check through the official site from your bookmarks.
QWhat should I do if I see trades I did not make?
The company asks customers to contact their trading provider (the securities or FX company) if they see trades they did not make. Before calling, change your password and log off, and save screenshots of your trading history so the situation is easier to explain. The company's notices do not say how losses will be handled, and this may differ between providers, so ask your provider. If you have suffered losses, you can also consult the cybercrime consultation desk of your prefectural police.