Onamae Desktop Cloud: the hosted desktop came with an extra tenant
Onamae Desktop Cloud confirms malware in customer servers and shuts down all plans for investigation
GMO confirms unauthorized programs in some Onamae Desktop Cloud customer environments, with 26,739 servers potentially affected. All plans began shutting down at 04:00 JST on October 21. Server data may have been viewed; confirmed data misuse has not been reported.
- Disclosed
- Oct 21, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Onamae Desktop Cloud customers; 26,739 servers potentially affected, not confirmed infected
- onamae
- In the wild
- Yes
- Vendor confirms unauthorized programs installed on customer servers
What happened
The vendor distinguishes possible exposure from proven misuse: the server total is a potential scope, not an infection count. Its dated notice does not identify the access method or attacker. L4 reflects confirmed compromise of customer environments at a hosting provider.
Crime-scene timeline
Oct 20, 2026
Vendor confirms malicious programs in some customer environments
Oct 20, 19:00 UTC
Service shutdown begins across all plans
October 21 at 04:00 JST; the cited vendor notice is dated October 21.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Onamae official noticePrimary26,739 potentially affected servers; malware confirmed in some environments; data misuse unconfirmed
- BleepingComputerReports the service-wide interruption and credential-rotation advice