Japanese Cloud Services Halted Following Malware Breach on Hosted Servers

A major cybersecurity incident has forced Japan-based cloud hosting provider Onamae.com Desktop Cloud to begin shutting down customer servers after malware was discovered within client environments. The company has taken the extraordinary step of suspending operations across all service plans as it works to contain the threat and investigate the scope of the compromise.

According to the provider, as many as 26,739 servers could potentially be impacted. While this figure represents the number of systems that may have been exposed, it does not indicate that every one of those servers has been confirmed as infected.

The malware was identified on October 20, 2026, prompting the company to initiate emergency shutdown procedures beginning at 4:00 a.m. JST on October 21. Onamae stated that the decision was made to prevent additional damage and limit the spread of the threat while forensic investigations are underway.

As a result, customers across all subscription tiers have lost access to their hosted environments, with the provider yet to announce a timeline for service restoration.

Data Exposure Concerns Emerge

Initial findings indicate that malicious software was present in certain customer server environments, creating the possibility that information stored on affected systems may have been accessed by unauthorized parties.

However, the company has not publicly disclosed critical details about the attack. The nature of the malware, its capabilities, the method of intrusion, and the identity of the threat actors remain unknown. While the incident confirms that unauthorized access occurred, the full extent of the compromise has yet to be established.

Notably, Onamae has not reported any confirmed theft of customer data. Likewise, it stated that there is currently no evidence that attackers misused information that may have been exposed during the incident.

The provider also emphasized that it does not store customer payment information, including credit card data. Nevertheless, concerns remain regarding data, credentials, applications, and other sensitive information housed within customer-managed server environments.

All Customers Impacted by Precautionary Shutdown

Rather than isolating only the environments known to contain malware, Onamae elected to suspend operations across its entire Desktop Cloud platform. This broad containment measure reflects the uncertainty surrounding the attack and the possibility of wider compromise.

For organizations relying on the service, the disruption creates a dual challenge: operational downtime and unresolved questions about the security of data stored within their cloud-hosted systems.

At present, the company has not identified which customer accounts, files, applications, or services may have been affected, nor has it disclosed whether any information was copied or exfiltrated by attackers.

Limited Technical Information Released

The provider has shared few technical details regarding the breach. It has not revealed whether the attackers exploited a software vulnerability, abused stolen credentials, or gained access through another attack vector.

Similarly, there is no public evidence linking the incident to ransomware activity, a supply-chain compromise, or any known cybercrime group. Security researchers and customers alike remain without answers about how the intrusion occurred and what specific actions the malware performed once deployed.

Potential risks include credential theft, remote access, data collection, or lateral movement within hosted environments, but these remain speculative until a complete forensic analysis is released.

Customers Urged to Change Credentials

One of Onamae’s key recommendations is that customers immediately update authentication credentials associated with their servers.

The company specifically advised users to replace passwords, login details, and other authentication information stored on or used within affected environments. While this does not confirm that credentials were stolen, it reflects the possibility that attackers may have had visibility into sensitive account information.

Security experts generally recommend changing any reused passwords on external services as well, reducing the risk of account compromise if credentials were exposed.

Warning Issued Over Potential Phishing Attempts

Onamae has also cautioned customers to remain alert for phishing campaigns and fraudulent communications seeking to exploit confusion surrounding the incident.

Attackers often capitalize on high-profile outages by impersonating customer support teams and requesting login credentials, payment information, or other sensitive data under the guise of restoring access.

The company stressed that it will never request passwords or credit card information via email or telephone, urging customers to ignore and report any suspicious messages claiming to originate from the provider.

While there is currently no indication that a phishing campaign targeting affected users is active, the warning serves as a precautionary measure as threat actors frequently attempt to leverage major cybersecurity incidents for follow-on attacks.

Investigation Continues

With thousands of customer servers offline and critical questions still unanswered, the incident highlights the risks associated with cloud infrastructure compromises. Until Onamae releases additional findings, customers are encouraged to follow security guidance, rotate credentials, monitor accounts for unusual activity, and remain vigilant against social engineering attempts.

The company continues to investigate the breach and has not yet provided an estimated timeline for restoring services.