Japanese Cloud Provider Onamae.com Shuts Down Servers After Malware Discovery

Japanese cloud provider Onamae.com has initiated a widespread shutdown of its Desktop Cloud servers after discovering malicious software within customer environments. The incident, confirmed on October 20, 2026, led to the cessation of services starting at 4:00 a.m. Japan time on October 21, with the company citing the need to prevent further damage. This drastic measure impacts all Onamae.com Desktop Cloud plans, leaving customers without access to their hosted systems while an investigation is underway. The provider has not yet provided an estimated restart date for the affected services.

Onamae.com has indicated that up to 26,739 servers may be affected, though this figure represents the potential scope rather than a confirmed count of compromised systems. The company stated that information stored within the affected server environments may have been viewed by attackers. However, details regarding the specific type of malware, the entry point used by the threat actors, or the exact nature of the impact remain undisclosed. While the provider has not confirmed any data theft or misuse of information that may have been viewed, nor any confirmed leak of its own customer personal information, the warning about potential data viewing within customer servers remains a significant concern.

The technical details surrounding the intrusion are notably limited. Onamae.com has not publicly identified how attackers gained initial access, nor has it specified the functionality of the discovered malicious programs. This lack of information makes it difficult to categorize the incident definitively as ransomware, a supply chain attack, or the work of a known threat actor group. The primary immediate concern for customers, beyond potential data exposure, is the risk of credential compromise. Onamae has advised customers to change login credentials used on or stored by the affected servers, a directive that underscores the potential for unauthorized access to accounts.

Customers are also being warned about potential phishing campaigns that may exploit the ongoing incident. Onamae.com has cautioned users against sharing passwords or credit card information via email or telephone, emphasizing that they will never request such sensitive data through these channels. This advisory serves as a preventive measure, as the company has not confirmed that a specific phishing campaign has already targeted its customers. The warning highlights a common tactic where threat actors leverage service disruptions to trick users into revealing sensitive information, potentially leading to further account takeovers.

The provider's public disclosure offers minimal technical indicators of compromise (IoCs), such as malware hashes, filenames, attacker IP addresses, or malicious domains. This scarcity of technical data complicates immediate threat hunting and defense efforts for security teams. The situation underscores the critical importance of robust security practices for cloud service providers and the need for transparent communication during security incidents.

While the exact nature of the malware and the attack vector remain unknown, the incident serves as a stark reminder of the persistent threats targeting cloud infrastructure. The potential for data viewing and the forced shutdown of services highlight the significant impact such attacks can have on businesses relying on cloud hosting. Customers are urged to follow Onamae.com's instructions regarding credential changes and to remain vigilant against potential follow-on phishing attempts.

The ongoing investigation by Onamae.com aims to fully understand the scope and nature of the breach, with the ultimate goal of restoring services securely. Until then, businesses affected by the shutdown face operational disruptions and uncertainty regarding the security of their data. The provider's commitment to transparency and timely updates will be crucial in rebuilding customer trust.