GMO Internet Group has suspended its Onamae.com Desktop Cloud service across all tiers following the discovery of a cyberattack that compromised approximately 26,739 servers. The incident, involving the deployment of unauthorized malicious programs, has forced a sequential shutdown of the platform’s infrastructure to prevent further spread of the malware.
The breach has immediate consequences for a large segment of Japan’s retail trading community. Onamae.com is a prominent provider of optimized virtual private servers (VPS) for MetaTrader 4 (MT4), a platform used extensively by foreign exchange (FX) traders for automated high-frequency trading. The total suspension of services means that thousands of automated trading scripts have been halted, potentially exposing traders to market volatility without their established safeguards.
The Scale of the Compromise
According to reports from ASCII.jp, the compromise was identified after malicious programs were found active within the Desktop Cloud environment. While the malware gained access to tens of thousands of individual server instances, GMO Internet Group stated that customer payment and credit card information remains secure. The company maintains that payment data is stored on a separate infrastructure that was not impacted by the intrusion.
The current incident is being viewed not as an isolated breach, but as a central flashpoint in a broader wave of cyber-offensives targeting Japanese corporations throughout October 2026. The Wall Street Journal has reported that these attacks are increasingly linked to “Artex,” an AI-powered penetration tool developed in China. Artex is designed to automate the detection of server vulnerabilities and the subsequent deployment of malware, allowing threat actors to strike multiple targets simultaneously with high efficiency.
A National Cybersecurity Emergency
The disruption at Onamae.com follows a string of significant data breaches affecting millions of Japanese citizens this month. Other major entities recently targeted include Monogatari Corp, which suffered a breach of 10 million records, and Mr Max Holdings, which reported the compromise of 1.7 million accounts. The scale and frequency of these incidents led Chief Cabinet Secretary Minoru Kihara to characterize the current situation as a “state of emergency” for national cybersecurity.
Government investigators are currently weighing the potential involvement of foreign state actors, given the sophisticated nature of the AI-driven tools used in the campaign. The use of automated agents like Artex represents a significant shift in the threat landscape, as these tools can bypass traditional signature-based defenses by rapidly adapting their exploit methods in real-time.
For users of the Onamae.com Desktop Cloud, the recovery process remains uncertain. While the service remains offline, security experts recommend that affected users prepare to rotate all credentials, including API keys and trading platform passwords, once systems are restored. Additionally, users are advised to monitor for AI-driven phishing lures that may use the breach as a pretext to harvest further sensitive information.
