Onamae.com Desktop Cloud (GMO Internet) hacked October 2026: malware on up to 26,739 customer Windows VPS servers, MT4/MT5 trading logins exposed and service suspended. What should customers do?

What happened: GMO Internet's Onamae.com Desktop Cloud, a Windows remote-desktop VPS often used to run automated FX trading tools such as MT4/MT5, was accessed by an unauthorized party. GMO began investigating after a customer inquiry on October 19, 2026, confirmed malicious programs on customer servers on October 20, and suspended servers on all plans on October 21. About 26,739 servers may be affected. Information stored on the servers, including trading account logins saved in trading tools, may have been seen, and unauthorized trading activity was reported from October 21. GMO says payment and card data were not stored on these servers. As of October 26 there is no restoration date. Am I affected: if you had any Onamae.com Desktop Cloud server (any plan) running in October 2026, treat every credential stored or typed on it as exposed: trading tools and broker accounts, email, exchange or bank logins, saved browser passwords, API keys and remote-desktop passwords. What to do now: 1. From a different, clean device (not the cloud server), change the passwords of your trading tools (MT4/MT5) and trading accounts, and log out of all sessions. 2. Review transaction history, open positions and balances at each broker. If you see trades or withdrawals you didn't make, contact the broker right away and file a report with the police. 3. Turn on two-factor authentication everywhere it is offered, starting with brokers and email. 4. Change every other password that was saved on the server or reused elsewhere, and revoke and reissue any API keys (broker, exchange, notification bots) that the server held. 5. Watch for phishing that uses the incident as a lure (fake 'restoration' or compensation messages); go to GMO's official notice page directly instead of following links in messages. After the service returns: don't copy files, EAs or settings back from the old server image without checking them, since it was the place the malware ran. Prefer reinstalling trading tools from the broker's official download and setting new credentials. Follow GMO's notices for restoration steps and the compensation announced for customers. Sources: https://internet.gmo/en/news/article/247 https://ascii.jp/en/elem/000/004/444/4444344/ https://gbhackers.com/onamae-com-cloud-servers/