Xakerlar Onamae.com Desktop Cloud tizimiga ruxsatsiz kirishdi. Ular mijozlar server muhitlariga zararli dasturlarni o‘rnatdi, bu esa yapon provayderini barcha tariflar bo‘yicha xizmatlarni to‘xtatishga majbur qildi.
Kompaniya 26 739 ta potentsial ta’sir ostidagi serverni aniqladi va shu tizimlarda saqlangan ma’lumotlar ko‘rib chiqilgan bo‘lishi mumkinligi haqida ogohlantirdi.
Onamae.com’ni boshqaradigan GMO Internet 2026-yil 20-oktabrda zararli o‘rnatishlarni tasdiqladi. 21-oktabrdagi e’lonida 4:00 dan (Yaponiya vaqti bilan) boshlab serverlarni bosqichma-bosqich o‘chirish boshlanishi aytildi, bu esa keyingi zararni oldini olish va mijoz muhitlarini tekshirish maqsadida amalga oshirilmoqda. E’londa tasdiqlangan tiklanish sanasi ko‘rsatilmagan.
Bu raqam potentsial ta’sir ostidagi serverlar sonini bildiradi, tasdiqlangan zararli dastur yuqtirishlari yoki alohida mijozlar sonini emas.
Kompaniyaning hodisa haqidagi e’lonida zararli dastur, dastlabki kirish vektori, foydalanilgan zaifliklar, doimiylik mexanizmlari yoki hujumchi infratuzilmasi aniqlanmagan.
Shuningdek, mijozlar mustaqil tahdid ovlash uchun foydalanishi mumkin bo‘lgan xeshlar, zararli domenlar yoki boshqa buzilish ko‘rsatkichlari ham taqdim etilmagan.
Shu sababli, e’lon hujumchilar markazlashtirilgan boshqaruv komponentini, alohida virtual serverlarni yoki xizmatning boshqa qismini buzganligini aniqlamaydi.
Onamae.com faqat ba’zi mijoz muhitlarida zararli dasturlar borligini tasdiqladi, bu esa haqiqiy yuqtirish soni va ruxsatsiz ma’lumotlarga kirish darajasini aniqlanmagan holda qoldirdi.
Shuningdek, bu hujumni ma’lum tahdid aktoriga bog‘lash yoki zararli dasturlarni ransomware, ma’lumot o‘g‘irlovchi yoki kriptomayner sifatida tasniflash uchun ham asos yo‘q.
Onamae.com kompaniyaga ishonib topshirilgan mijoz shaxsiy ma’lumotlarining sizib chiqishi yoki hujum paytida ko‘rib chiqilgan ma’lumotlardan noto‘g‘ri foydalanish tasdiqlanmaganini aytdi.
Shuningdek, u to‘lov ma’lumotlari, jumladan kredit karta tafsilotlarini saqlamasligini alohida ta’kidladi. Bu bayonotlar ta’sir ostidagi mijoz serverlarida saqlangan ma’lumotlar kirish mumkin emasligini isbotlamaydi.
Desktop Cloud masofadan foydalanish mumkin bo‘lgan virtual serverlarni taqdim etadi va avtomatlashtirilgan valyuta savdosi dasturlarini ishlatish uchun ishlatiladi.
Bu infratuzilma hodisasi va potentsial ochilgan savdo ma’lumotlari, shuningdek doimiy ishlaydigan yuklamalarga ta’sir qiluvchi xizmat uzilishi o‘rtasida to‘g‘ridan-to‘g‘ri bog‘liqlik yaratadi.
Bog‘liq hodisada, OANDA Japan 22-oktabrda mijozlarga ogohlantirish berdi: Desktop Cloud’da MetaTrader 4 va MetaTrader 5 platformalari bilan ishlatilgan kirish identifikatorlari va parollari uchinchi shaxslar tomonidan ko‘rib chiqilgan bo‘lishi mumkin.
Brokerning ogohlantirishi hodisaning ahamiyatini server mavjudligidan tashqari, hisob xavfsizligiga ham kengaytiradi.
OANDA mijozlarga My Page va MT4/MT5 parollarini o‘zgartirish, mavjud ikki faktorli autentifikatsiyani yoqish, savdo tarixini tekshirish va shubhali operatsiyalar haqida qo‘llab-quvvatlashga murojaat qilishni tavsiya qildi.
Uning maslahati ruxsatsiz savdolar sodir bo‘lganini tasdiqlamadi; u potentsial ma’lumot ochilishi ehtimoliga qarshi ehtiyot choralarini bayon qildi.
Onamae.com mijozlarga serverlarida saqlangan yoki ishlatilgan autentifikatsiya ma’lumotlarini darhol o‘zgartirishni buyurdi. Bu parollarni boshqa joylarda qayta ishlatgan mijozlarga ularni o‘sha xizmatlarda ham o‘zgartirish aytildi.
Bu so‘rov ma’lumotlarni tekshiruvchilar buzilishning to‘liq ko‘lamini aniqlaguncha ham, ma’lumotlarni darhol javob ustuvorligiga aylantiradi.
Provayder shuningdek, hodisadan foydalanib yuboriladigan fishing xabarlari va shubhali aloqalar haqida ham ogohlantirdi. U xodimlar hech qachon elektron pochta yoki telefon orqali parol yoki kredit karta ma’lumotlarini so‘ramasligini ta’kidladi.
O‘chirish Desktop Cloud’ning har bir tarifini qamrab oladi, lekin e’londa Onamae.com’ning boshqa takliflari bo‘yicha teng to‘xtatishlar e’lon qilinmagan.
Tekshiruvchilar server tekshiruvlarini davom ettirmoqda va kompaniya keyingi natijalarni e’lon qilish hamda tasdiqlangandan so‘ng xizmatni qayta boshlashni aytib o‘tdi.
Hackers gained unauthorized access to Onamae.com Desktop Cloud. They installed malicious programs in customer server environments, prompting the Japanese provider to suspend services across all plans.
The company identified 26,739 potentially affected servers and warned that information stored on those systems may have been viewed
GMO Internet, which operates Onamae.com, confirmed the malicious installations on October 20, 2026. Its October 21 disclosure announced rolling server shutdowns beginning at 4:00 a.m.
Japan time to prevent further damage while investigators examined customer environments. The notice provided no confirmed restoration date.
The figure represents potentially affected servers, not verified malware infections or individual customers.
The company’s incident notice does not identify the malware, initial access vector, exploited vulnerabilities, persistence mechanisms, or attacker infrastructure.
It also provides no hashes, malicious domains, or other indicators of compromise that customers could use for independent threat hunting.
Consequently, the disclosure does not establish whether attackers compromised a centralized management component, individual virtual servers, or another part of the service.
Onamae.com confirmed, malicious programs on only some customer environments, leaving the actual infection count and extent of unauthorized data access unresolved.
It likewise offers no basis for attributing the intrusion to a specific threat actor or classifying the malicious programs as ransomware, credential stealers, or cryptominers.
Onamae.com said it had not confirmed leakage of customer personal information entrusted to the company or misuse of information potentially viewed during the intrusion.
It separately stated that it does not retain payment information, including credit card details. These statements do not establish that data stored inside affected customer servers remained inaccessible.
Desktop Cloud provides remotely accessible virtual servers and is used to operate automated foreign exchange trading software.
That creates a direct connection between the infrastructure incident and potentially exposed trading credentials, alongside service disruption affecting continuously running workloads.
In a related development, OANDA Japan warned customers on October 22 that login IDs and passwords used with its MetaTrader 4 and MetaTrader 5 platforms on Desktop Cloud may have been viewed by third parties.
The broker’s warning extends the incident’s relevance beyond server availability to account security.
OANDA urged clients to change their My Page and MT4/MT5 passwords, enable available two-factor authentication, review trading histories, and contact support about suspicious transactions.
Its advisory did not establish that unauthorized trades had occurred; it outlined precautions against possible credential exposure.
Onamae.com instructed customers to change authentication information stored or used on their servers immediately. Customers who reused those passwords elsewhere were told to change them on those services as well.
The request makes credentials an immediate response priority, even while investigators determine the breach’s full scope.
The provider also warned about phishing messagesand suspicious communications exploiting the incident. It emphasized that staff would never request passwords or credit card information by email or telephone.
The shutdown covers every Desktop Cloud plan, but the notice does not announce equivalent suspensions across Onamae.com’s other offerings.
Investigators are continuing server examinations, and the company said it would disclose further findings and announce service resumption once confirmed.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.