MediumII Cyber Warfare & Critical Infrastructure20 October 2026, Tuesday · 22:00 TRT (UTC+3)
Breach of GMO cloud service forces 26,739 servers offline in Japan
GMO Internet found on 20 October that an intruder in its Onamae.com Desktop Cloud infrastructure had installed malicious software on customer servers. From 04:00 Japan time on 21 October, 26,739 servers across all plans are being shut down in sequence. No restart date has been given.
GMO Internet is one of Japan's largest domain registrars. Its notice dated 21 October said it confirmed on 20 October that unauthorised programs had been installed in some customer environments on its Desktop Cloud virtual server service. The number of servers potentially affected is 26,739. To contain the damage, the company is shutting down servers on all plans in sequence from 04:00 on 21 October (22:00 TRT on 20 October). It has not said when the service will resume.
The notice says data stored on the servers may have been viewed. As of 21 October, however, no leak or misuse of personal data had been confirmed. The company says it does not hold payment details such as credit card numbers on this infrastructure. The attacker's identity and method of entry were not disclosed, and a BleepingComputer report on 21 October also noted that the perpetrator remains unknown.
The service's customer base shapes the financial side of the incident. According to BleepingComputer, Desktop Cloud was marketed for running MetaTrader 4, the automated forex trading software, without interruption. The company asked customers to change passwords and secret keys stored on the servers. It also warned them to watch for a rising risk of phishing, meaning credential theft through fake emails. Its support line said on 21 October that response times could lengthen because of heavy demand.
Talay assessment
Bottom line
Shutting down 26,739 servers at once shows this was access at the level of the provider's infrastructure, not a series of individual customer breaches. Until the attacker and method are disclosed, the scale of the impact will remain unclear. The main risk is that trading account passwords and keys held on the servers are used in a second wave of attacks.
Likely effects
- Retail forex tradersNegativeWeeks
Because the service was marketed to MetaTrader 4 users, the shutdown halts automated trading strategies; if broker passwords on the servers were stolen, accounts could be taken over.
- Japanese cloud oversightUncertain1–6 months
A provider breach that takes 26,739 servers offline in one go will speed up debate in Japan on binding security rules for cloud and hosting services.
- Phishing waveNegativeWeeks
GMO warned customers about fake support emails and calls; the owners of 26,739 servers form a ready-made list for targeted credential theft.
Possibilities, ranked
- 1Extended outage, limited leak50%
The service stays down for weeks; the investigation confirms infrastructure access, but no mass leak of personal data is proven.
Watch: A restart date and the method of entry in GMO's updated notice
- 2Data leak confirmed35%
A leak of passwords and keys from the servers is confirmed, and complaints of unauthorised trades on brokerage accounts begin.
Watch: A notification to the Personal Information Protection Commission or account takeover warnings from brokers
- 3Quick recovery15%
Servers come back within days on clean images, and the incident closes as a contained malware infection.
Watch: Service restored across all plans before early November
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Servers potentially affected▲ 26,739
- Plans shut down▲ All