GMO Internet told customers to back up, disconnect and power down before noon on October 27, 2026, after the Onamae Desktop Cloud ransomware actor threatened to trigger a payload staged on up to 26,739 hosted servers. None appears to have detonated. The data leak happened anyway, and MetaTrader 4/5 logins may be in it.
Key takeaways
- Malware may sit on up to 26,739 Onamae servers after an intrusion detected October 20, 2026.
- GMO refused a ¥8 billion (about $50M) ransom; data leaked, but no ransomware appears to have fired.
- Rotate MT4/MT5 credentials and revoke sessions at the broker; rebuilding the VPS does not. Log every step for DORA and GDPR.
What happened at GMO's Onamae Desktop Cloud?
Onamae Desktop Cloud is a Japanese VPS service run by GMO Internet, one of Japan’s largest domain registrars. GMO detected an intrusion on October 20, 2026, and says malware may have been planted on up to 26,739 customer servers. It shut servers down while it investigated.
The reports name no threat actor, ransomware family, CVE or entry point. The pattern is familiar: a hosting provider controls imaging and remote management, so one foothold reaches thousands of tenant machines.
What did the Onamae Desktop Cloud ransomware actor demand, and what leaked?
The attacker demanded ¥8 billion (about $50 million). GMO refused.
- October 26: GMO warned the actor would publish customer data and trigger a payload planted earlier.
- October 27, before noon: customers were told: “Once you have a backup, disconnect the network, power it down, and unplug the cord that connects to your PC.” GMO worked with Trend Micro to scan and recover.
- Later update: GMO confirmed company and customer data had been published and threatened legal action against anyone spreading it.
BleepingComputer reports that no ransomware appears to have been activated on customer machines. GMO says payment information was not exposed. It is paying ¥5,000 (about $30) per customer, possibly more for those whose data leaked, and has promised replacement PCs for ransomware damage.
Why do leaked MetaTrader credentials matter to Cyprus brokers?
GMO warns that MT4/MT5 credentials and trading-account details may have been compromised, and told customers to reset passwords and end active sessions.
The breach sits with the hosting supplier, but the fallout lands on broker accounts: unfamiliar-device logins, unauthorized orders, changed withdrawal details. A leaked investor password exposes positions; a leaked master password lets someone trade. Rebuilding the VPS revokes neither. As in the Danish case where one supplier account exposed millions of records, the weak point was a supplier.
What should regulated firms check now?
Find out whether anyone you depend on used Onamae Desktop Cloud, then treat every credential on those machines as exposed.
- Inventory: staff, contractors, introducing brokers and white-label partners hosting terminals or Expert Advisors there.
- Rotate from a clean device: master and investor passwords, email and remote-access credentials. Kill active sessions broker-side.
- Review accounts: device history, trades, Expert Advisors and withdrawal changes since October 20.
- Leave the dump alone: downloading it creates its own GDPR problem.
Practitioner’s note: in supplier-compromise exercises we run for brokers, nobody owns the list of third-party hosts holding live trading credentials, and backups get restored wholesale. Restore onto a clean image and keep an untouched copy for investigation.
Where do DORA, NIS2 and GDPR fit?
Under DORA, which has applied since January 17, 2025, a hosted desktop running dealing or client terminals is an ICT third-party dependency and belongs in your register of information. If personal data you control was exposed, GDPR’s 72-hour notification clock may already be running.
Log when you learned of the incident, whom you notified and which sessions you revoked. A ransomware readiness assessment tests whether you could act on a noon deadline; NIS2 and DORA compliance readiness shows where suppliers like this sit in your register.
FAQ
Did GMO pay the ransom?
No. GMO refused the ¥8 billion (about $50 million) demand.
Should MetaTrader users reset passwords even if their VPS looks clean?
Yes. A clean scan does not prove credentials were never copied; change master and investor passwords from a clean device and end broker sessions.
If your dealing desk or clients depend on hosted terminals, our CySEC ICT risk penetration testing maps where those third-party machines can reach your trading and client data.