Attackers installed malware inside customer server environments at Japan’s Onamae.com Desktop Cloud, prompting the provider to begin shutting down servers across every service plan.
Onamae listed 26,739 servers as potentially affected, a number that indicates the possible scope rather than a confirmed count of infected systems. The figure raised concerns about data and credentials stored on those servers.
The company says it discovered the malicious software on October 20, 2026, and started stopping customer servers at 4:00 a.m. Japan time on October 21.
Its public incident notice said the shutdown was intended to prevent further damage. No restart date was provided, leaving customers without access while the investigation continues.
Onamae reported finding malware in some customer server environments and warned that information within those systems may have been viewed.
However, the company’s disclosure does not name the malware, describe what it does, or say how the attackers first gained access. The notice confirms an intrusion but leaves the attack chain unresolved.
Provider shuts down all plans after malware discovery
The shutdown affects all Onamae.com Desktop Cloud plans rather than only the servers where malware was confirmed. While servers are stopped, customers cannot use the service.
The response resembles the emergency server shutdown that was previously issued for ShareFile, though that case was a precautionary step against a potential threat rather than a confirmed malware presence.
For customers the immediate impact is twofold: loss of access to rented servers and uncertainty about information stored on those systems. Onamae has not publicly identified specific files, accounts, or applications that were affected.
The provider also has not stated whether attackers copied data to other locations. Because that has not been confirmed, any suggestion that viewed information equals confirmed data theft would be premature.
Onamae said it has found no confirmed leak of customer personal information that it stores, and no confirmed misuse of information that may have been viewed. The company also stated it does not retain payment information, including credit card details. Those statements, however, do not eliminate the risk to data contained inside customer servers.
Technical details remain limited
Onamae has not disclosed an entry point, a specific vulnerability, or an identified attacker. Its notice does not clarify whether the malware exfiltrated passwords, established remote access, or performed other actions.
Labeling the incident as ransomware, a supply-chain compromise, or activity by a known threat group would exceed the available evidence.
Cloud-targeting malware can be designed to harvest secrets stored in hosted systems. In another case, reporting on credential-theft malware for cloud servers described tools built to collect cloud access details. That example illustrates the wider concern around compromised servers but does not provide evidence that the same tools or actors are responsible at Onamae.
Onamae’s instruction asking customers to change login credentials makes credential exposure an immediate concern even though the company has not published a malware analysis. It specifically told customers to change authentication information stored on or used by the affected servers. That guidance addresses a potential route to further account access, not proof that every saved password was taken.
Users should follow Onamae’s advice: promptly replace any exposed login details and change matching passwords used on other services.
The separate breach of ConnectWise backup credentials showed how a compromised vendor secret can enable unauthorized access across customer environments. That comparison underscores why access details matter, but it does not explain how the Onamae incident began.
Onamae also warned customers to be alert for phishing emails and other suspicious messages that could exploit the incident. The company emphasized it will never ask for passwords or credit card information by email or telephone.
Customers affected by the outage should treat such requests cautiously, particularly if a message claims that sharing account details is necessary to restore access.
Security-themed messages can themselves be used as an attack vector; recent reporting on passkey-themed phishing described attackers impersonating support staff to capture cloud credentials. Onamae’s advisory is precautionary: it does not confirm that a related phishing campaign has already targeted its customers.
Indicators of compromise (IoCs)
| Indicator type | Source disclosure |
|---|---|
| SHA-256, SHA-1, MD5 hashes | Not published |
| Malicious filenames or paths | Not published |
| Attacker IP addresses | Not published |
| Malicious domains or URLs | Not published |
| Malware family | Not identified |
Note: IP addresses and domains are commonly defanged (for example, by replacing dots) to avoid accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.
Update defenses against new malware as soon as it appears. Integrate threat intelligence feeds with data from SOCs.
