From our other sites
The story
Unauthorized access by a third party occurred on “Onamae.com Desktop Cloud,” a service provided by GMO Internet Group, prompting the company to issue multiple notices between October 21 and 26 and once again ask users to cooperate with its investigation (on a voluntary basis). The service is a virtual server (VPS) aimed at FX auto-trading (EA) and running MT4/MT5, and many individual users reportedly keep it running around the clock. On 5ch, reactions spread in several directions — debate over whether users should hand over their PCs or protect themselves by wiping their data, questions about what the disclosed figure of “26,739 cases” actually means, and technical explanations of the intrusion route.
GMO INTERNET GROUP
As of 21:00 on October 26, 2026
Regarding the unauthorized access by a third party to “Onamae.com Desktop Cloud,” which we announced between October 21 and today, we are once again providing an update on the status of our ongoing investigation and a request to our customers.
Source: group.gmo / Original article here
What people said
Don't worry about the data on it, though, the hacker will kindly email it back to your family.
No idiot's actually going to open a file a hacker sends them.
Can't they just whip up some security software for us for 30,000 yen?
You'll be getting a bill (itemized usage statement) for a few hundred thousand yen, desu.
No way anyone's reckless enough to actually do that.
Don't delete the evidence of the damage.
It's your basis for filing a damages claim against GMO.
Could be worth millions of yen.
Lol, it's written like the criminal themselves addressed the users: "To all users: keeping the evidence saved will be a powerful tool for winning in court."
(The implied nuance: if you're worried about further access, just safely back it up somewhere separate from the PC — a USB drive, whatever — and you're fine.)
Meanwhile GMO's clearly hoping you'll just delete it. A real tug-of-war.
I've never done FX, but…
the name and what it actually does seem totally unrelated. Is that just how it is?
Apparently people who do FX auto-trading hate the missed-opportunity cost of their PC rebooting for Windows Update and the like, so they just leave a virtual desktop in the cloud running 24/7 instead.
Nah, more like the Battle of Leyte Gulf.
A Kyoto local would probably answer with "the Battle of Goryō" instead (riffing on the joke that Kyoto locals treat centuries-old events as "recent").
No way.
There's no way to seize admin rights on the server from the client side.
This is a case where the server itself got taken over, and from there a virus got pushed onto everyone who was accessing it.
https://note.com/hirokimiyano/n/ne929648b027f
Read this.
Originally it was just a rented VPS, and from there, through a sloppily configured network, they were able to reach all the way to customers' PCs via RDP.
that's not 26,739 physical server boxes —
it's surely the number of VPS instances.
But when the media hammers on "26,739"
and throws in footage of a data center's massive server racks at the same time,
people end up going "whoa, THAT many of those?!"
I guess it's the number of independent virtual server environments per user?
I was picturing some insane data center,
but that's a bit of a letdown.
Background and Key Points of This Discussion
“Onamae.com Desktop Cloud” is a VPS (virtual private server) service GMO offers for FX auto-trading (EA) and running MT4/MT5, and it’s mainly used by people who want to keep it running 24/7 to avoid reboots from things like Windows Update. The thread split into two main points of debate. The first was how seriously to take the “request for cooperation with the investigation (optional)” in the announcement — opinions were divided over whether users should hand over their PCs, and whether the data on them should be preserved as evidence or wiped. The second was how to interpret the scale of the damage: the figure of “26,739 cases” cited by GMO is thought to refer not to the number of physical servers in a data center, but to the number of virtual servers (VPS instances) assigned to individual customers — something commenters noted could easily be misread as far larger depending on how the media frames it. As for the intrusion route, the theory most favored in the thread is that the breach didn’t come through client PCs, but instead spread to customers’ machines via RDP due to a misconfigured network on the server side.
*This article is excerpted and summarized from the 5ch (News Flash+) thread “[GMO] To Customers Using “Onamae.com Desktop Cloud”… Including a Request for Cooperation with the Investigation (Optional).”
Leave a Reply