Zero Radar
← feed
HighSecurity incidentupdated 28 Oct 2026, 12:50 UTC

GMO Onamae Desktop Cloud breach: hackers threaten ransomware, customers told to shut down PCs

Hackers broke into a Japanese cloud service that gives customers remote Windows computers. They threatened to lock up data with ransomware, so customers were told to unplug their PCs from the internet and shut them down.

Attacks reported (BleepingComputer, The Hacker News)3 independent sources
SeverityHighSecurity incident
Being exploited?ReportedBy BleepingComputer, The Hacker News, DataBreaches.net, not officially confirmed yet
What to doCheck exposureDisconnect affected Onamae Desktop Cloud PCs from the internet and shut them down as GMO advises, after backing up your data.
How sure is this?3 independent sourcesSeveral independent publishers agree

How the attack works simplified

  1. 1Attacker breaches serviceGains access to Onamae Desktop Cloud
  2. 2Extortion demandDemands payment under ransomware threat
  3. 3Ransomware threatenedAttacker threatens to launch attack
  4. 4Customers disconnectGMO advises shutting down PCs
  5. ResultCustomer systems at risk of ransomware

What happened

Attackers breached GMO Group's Onamae Desktop Cloud, a hosted Windows desktop service used for FX trading, and demanded payment under threat of ransomware, which GMO refused to pay.

Why it is dangerous: Customers who run trading or business work on these hosted desktops could lose access to data or systems, and attackers may use the breach to demand money or steal information.

Are you affected?

You are affected if you use GMO Internet Group's Onamae Desktop Cloud service to host Windows desktops, including for FX trading.

GMO Onamae Desktop Cloud (Onamae.com Desktop Cloud service) customers

What to do

  1. Follow GMO's instructions: scan your computer for viruses, back up your data, disconnect from the internet, then shut down
  2. Check with GMO for official guidance before reconnecting or restoring service
  3. Report any suspicious activity or contact with GMO and the relevant authorities

Timeline

  1. 27 Oct 2026, 23:35 UTC
    Publicly disclosed
  2. 27 Oct 2026, 23:35 UTC
    Reported by BleepingComputer · BleepingComputer
  3. 27 Oct 2026, 23:37 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 07:15 UTC
    The Hacker News reported on it · The Hacker News
  5. 28 Oct 2026, 12:50 UTC
    DataBreaches.net reported on it · DataBreaches.net

Sources 3 reports, oldest first

Security press established security newsrooms

Technical details

ID
ZR-5246b127
Disclosed
27 Oct 2026, 23:35 UTC
On Zero Radar
27 Oct 2026, 23:37 UTC (2 min after disclosure)
Last change
28 Oct 2026, 12:50 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

GMO Onamae Desktop Cloud breach: hackers threaten ransomware, customers told to shut down PCs · Zero Radar