Onamae.com, the Japanese domain and hosting brand run by GMO Internet, said an unauthorized third party gained access to its Desktop Cloud service and installed malicious programs in some customers’ server environments. In its notice, the company says it confirmed the intrusion on October 20 and that up to 26,739 servers may be affected. Data stored on those servers may have been viewed, and the investigation is continuing.
The company began shutting down Desktop Cloud servers at 04:00 local time on October 21, and the shutdown covers all plans. No restart date has been given. Desktop Cloud is a hosted desktop service that the company advertises for always-on forex trading with MetaTrader 4, according to BleepingComputer. The company has not confirmed any misuse or leak of information, and BleepingComputer reports it says payment card details are not affected because they are stored on separate infrastructure. The notice is published in Japanese; the figures above are from that notice and from BleepingComputer’s report.
How to check if you’re affected
Affected products are Onamae.com Desktop Cloud servers on any plan; the company says up to 26,739 servers may have been affected, but has not said which ones. If you are a customer:
- Change any password or other credential stored or used on your Desktop Cloud server as soon as possible, which is the company’s own instruction. If you reused the same password on other services, change it there too.
- Expect phishing built around the incident. The company says it will never ask for a password or credit card number by email or phone, so treat any message that does as fraudulent and use the contact form or phone number in the official notice instead.
- Watch the official notice for updates on which servers were affected and when the service restarts.