{
  "id": "onamae-desktop-cloud",
  "url": "https://ohshit.app/incidents/onamae-desktop-cloud/",
  "title": "Onamae Desktop Cloud confirms malware in customer servers and shuts down all plans for investigation",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-10-21",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "cloud",
    "malware",
    "credentials"
  ],
  "ecosystems": [
    "onamae"
  ],
  "summary": "GMO confirms unauthorized programs in some Onamae Desktop Cloud customer environments, with 26,739 servers potentially affected. All plans began shutting down at 04:00 JST on October 21. Server data may have been viewed; confirmed data misuse has not been reported.",
  "splash": "Onamae Desktop Cloud customers; 26,739 servers potentially affected, not confirmed infected",
  "wipe": "Rotate credentials stored on affected desktops, check connected-service logs and await vendor recovery guidance",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Rotate credentials stored or used on the hosted desktops from a clean device"
    },
    {
      "title": "Change reused passwords on other services"
    },
    {
      "title": "Review connected accounts for unauthorized activity"
    },
    {
      "title": "Follow official recovery notices and beware of phishing"
    }
  ],
  "sources": [
    {
      "name": "Onamae official notice",
      "url": "https://www.onamae.com/news/article/11584",
      "says": "26,739 potentially affected servers; malware confirmed in some environments; data misuse unconfirmed",
      "primary": true
    },
    {
      "name": "BleepingComputer",
      "url": "https://www.bleepingcomputer.com/news/security/japans-onamae-desktop-cloud-hacked-up-to-27-000-servers-affected/",
      "says": "Reports the service-wide interruption and credential-rotation advice",
      "primary": false
    }
  ],
  "headline": "Onamae Desktop Cloud: the hosted desktop came with an extra tenant",
  "one_liner": null,
  "in_the_wild_note": "Vendor confirms unauthorized programs installed on customer servers",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 20, 2026",
      "title": "Vendor confirms malicious programs in some customer environments"
    },
    {
      "date": "Oct 20, 19:00 UTC",
      "title": "Service shutdown begins across all plans",
      "body": "October 21 at 04:00 JST; the cited vendor notice is dated October 21."
    }
  ],
  "body_markdown": "The vendor distinguishes possible exposure from proven misuse: the server total is a potential scope, not an infection count. Its dated notice does not identify the access method or attacker. L4 reflects confirmed compromise of customer environments at a hosting provider."
}