GMO "Onamae.com Desktop Cloud" breach: lessons for Hong Kong SMEs

Attackers planted a program on customer servers of GMO Internet's Onamae.com Desktop Cloud in Japan, and trading logins stored there may have been stolen. What happened, and what Hong Kong SMEs using cloud desktops or VPS should check now.

In October 2026, GMO Internet, Inc. in Japan disclosed that a third party had installed an unauthorized program in some customers' server environments on "Onamae.com Desktop Cloud" (お名前.com デスクトップクラウド), a hosted Windows desktop service many customers used to run trading tools. Login details for trading accounts stored on those servers may have been taken and misused. The service is Japanese, but the pattern is familiar to any Hong Kong business that keeps passwords on a cloud desktop or VPS. This article summarises what GMO has confirmed and the practical lessons for SMEs.

Note: based on GMO's official notices and media reports up to the Tenth Report (27 October 2026, 13:55 JST / 12:55 HKT). The investigation is ongoing and details may change.

What GMO has confirmed

Timeline: GMO began investigating on 19 October after a customer inquiry, and on 20 October confirmed the unauthorized program. From 21 October customers reported unauthorized transactions or other suspicious activity in their trading accounts. GMO consulted the police on 22 October.
Scope: all plans of the service. GMO put the number of potentially affected servers at 26,739, stressing this is not the number of confirmed cases.
Data: information customers stored on the servers, including trading account logins saved in trading tools. GMO says it does not store customer payment information, including card details, on those servers.
Response: all server operations were suspended and GMO is working with a security firm. As of 23 October, the date for resuming service was undetermined.
Leak and extortion: at 12:30 JST on 27 October GMO confirmed that people believed to be the attackers had published what they claim is information about GMO and its customers. GMO says the content may be inaccurate, warns that the leak site captures information about anyone who visits it, and is preparing legal action against malicious spreading. GMO's own timeline records a threatening email demanding about 8 billion yen; The Japan Times reported a demand of about US$1 million. GMO says it will not pay. As of 13:55 JST no ransomware attack had been confirmed, and GMO is still analysing customer devices. ITmedia reported that GMO will provide a new PC to customers whose PC is hit by ransomware.

What GMO asked its customers to do

Change the credentials for trading accounts and trading tools from a device not used for trading.
End all active login sessions, then check trading history and balances.
Set up two-factor authentication.
Beware of emails, SMS messages and phone calls impersonating GMO or related organisations. GMO says it will never ask for your password or authentication code.
Do not visit or share the attackers' published information.

Lessons for Hong Kong SMEs

1. A cloud desktop is a vault only if you treat it like one

Cloud desktops and VPS are convenient for running software 24/7, but whatever is saved inside them (browser passwords, tool logins, API keys, bank or broker credentials) is exposed if the environment is compromised, whether through your own mistake or the provider's. List what is stored on each server. Move secrets into a password manager or a secrets service, and remove saved logins you do not need.

2. Turn on MFA everywhere that matters

A stolen password is much less useful when the account also requires a second factor. Prioritise banking, brokerage, payment, email, domain and cloud admin accounts. See our guide to multi-factor authentication.

3. Know how to end sessions and rotate credentials

Changing a password does not always log out existing sessions or revoke tokens. For each key system, find out in advance where "sign out of all sessions" and key revocation live, and do the change from a clean device, as GMO advised.

4. Expect phishing that copies the vendor

After a public incident, criminals send fake "security notices" or "loss recovery" offers. Tell staff to ignore links and attachments in such messages and check the vendor's official website or known phone number instead.

5. Do not visit leak sites

Curiosity is risky. GMO warns that visitors' information is captured by the attackers. If you must assess exposure, leave it to your security adviser, and do not repost or forward leaked material.

6. Have a simple incident response plan

Write down who decides, who contacts the bank or broker, how to isolate and back up devices, who calls the police and your insurer, and how you tell customers. A one-page plan beats improvising under pressure.

7. Manage vendor risk

Before relying on a hosted service, ask how it isolates customers, how it notifies incidents and what you are responsible for. Assume any provider can be breached and limit what you store there. A zero trust approach helps: verify each access, and give each system only the access it needs.

How technine can help

We help Hong Kong businesses review cloud servers for stored credentials, roll out MFA and prepare incident response plans. Learn more about our cybersecurity and compliance services.