Japanese cloud provider shuts down after malware attack

Key Takeaways

• Japanese cloud provider Onamae.com Desktop Cloud initiated a full shutdown of customer servers following a malware intrusion.
• Up to 26,739 servers across all service plans are potentially affected, impacting customer data and login credentials.
• The shutdown began on October 21, 2026, with no immediate timeline for service restoration.
• Customers are advised to change all login credentials used on the affected servers and remain vigilant against phishing attempts.

A significant cybersecurity incident has forced Onamae.com Desktop Cloud, a prominent Japanese cloud service provider, to commence a complete shutdown of its customer server environments. The drastic measure was implemented after malicious software was discovered within multiple customer systems, raising concerns about data integrity and credential exposure.

The company has indicated that a substantial number of servers, specifically 26,739, could be impacted by the breach. This figure represents the maximum potential scope of the incident, not a definitive count of compromised systems. The widespread shutdown affects all service plans offered by Onamae.com Desktop Cloud, regardless of whether a specific server was confirmed to be infected.

Onamae confirmed the presence of the malware on October 20, 2026. In response, the provider initiated the server shutdown process at 4:00 a.m. Japan time on October 21. According to the official incident notice, this action was taken to contain the threat and prevent further damage. The notice did not provide an estimated restoration date, leaving customers without access to their services as the investigation proceeds.

Onamae identified the malicious programs within several customer server environments and has warned that information stored on these systems might have been accessed. However, the publicly released information remains sparse, lacking details on the specific malware variant, its operational capabilities, or the initial vector of the attack. While an intrusion has been confirmed, the complete attack chain has not yet been disclosed.

Impact on Customers and Data

The comprehensive shutdown of all Onamae.com Desktop Cloud plans means that customers are currently unable to utilize their services. This situation presents an immediate challenge for businesses and individuals reliant on these hosted environments, compounded by the uncertainty surrounding the security of their data.

While Onamae has not specified which files, accounts, or applications were affected, or whether data was exfiltrated, it has acknowledged the possibility that information within customer servers may have been viewed. The provider has clarified that it has not found evidence of a confirmed leak of its own customer personal information or confirmed misuse of any potentially viewed data. Furthermore, Onamae stated that it does not store customer payment details, such as credit card information. Despite these assurances, the warning regarding data within customer servers remains pertinent.

Limited Technical Disclosure

As of now, Onamae has not provided critical technical details, including the entry point of the attackers, any specific security vulnerabilities exploited, or the identity of the threat actor(s). The nature and functionality of the malware—whether it stole passwords, established remote access, or performed other malicious activities—also remain undisclosed. Without further information, attributing this incident to ransomware, a supply chain attack, or a known threat group would be speculative.

The provider’s recommendation for customers to alter their login credentials strongly suggests that credential exposure is a primary concern. Onamae specifically advised users to change authentication information stored or utilized on the compromised servers. This instruction aims to mitigate a potential avenue for further unauthorized account access, though it does not confirm that every saved password was stolen.

The incident underscores the broader risks associated with cloud server compromise, where attackers often target sensitive information like access credentials. While other instances of cloud malware designed to harvest access details exist, there is no evidence to link those specific tools or attackers to the Onamae breach.

In addition to credential changes, Onamae has issued a warning about potential phishing emails and suspicious communications attempting to exploit the ongoing incident. The company emphasized that it will never request passwords or credit card information via email or telephone. Customers experiencing service outages should exercise extreme caution when receiving such requests, particularly if they claim that sharing account information is necessary for service restoration.

Indicators of Compromise (IoCs)

What You Should Do

• Change Passwords Immediately: Promptly update all login credentials that were stored on or used to access your Onamae.com Desktop Cloud servers.
• Update Passwords Elsewhere: If you have reused any of these passwords on other services, change them on those platforms as well to prevent credential stuffing attacks.
• Enable Multi-Factor Authentication (MFA): Where available, activate MFA for all critical accounts to add an extra layer of security.
• Beware of Phishing: Remain highly vigilant for suspicious emails, messages, or phone calls claiming to be from Onamae.com. Do not click on unfamiliar links or provide personal or account information.
• Monitor Accounts: Closely monitor all accounts and financial statements for any unusual activity.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.