■ Requests to Customers (Urgent)

Customers who use trading tools or similar software on the Service should take the following actions.

・Change the passwords for your trading tools (e.g., MT4/MT5) from securities or FX brokerage firms and for your trading account credentials immediately. Make the changes from a device other than the Service's servers. After that, log off (disconnect your session).
・Check the transaction history and balance of your trading account. If you find any transactions you do not recognize, contact your broker or trading service provider.
・If your broker or trading service provider offers two-factor authentication or a similar feature, please enable it.
・If you store or use credentials (IDs, passwords, etc.) on the server, change them promptly. If you use the same password for other services, change those as well.

1. Overview

On October 20, 2026, we confirmed that a malicious program had been installed by a third party in the server environments of some customers of "Onamae.com Desktop Cloud."

Subsequent investigation and customer reports indicate that this unauthorized access may have allowed a third party to obtain trading account login information and other data stored on the servers, and to use it illegally.

2. Timeline

October 19: Began investigation after receiving an inquiry from a customer.
October 20: Confirmed the installation of a malicious program. Suspended new applications and the control panel.
October 21, 4:00: To prevent further damage, began suspending servers on all plans in sequence. Published the first report.
From October 21: Received customer reports of unauthorized operations on trading accounts. Shared the situation with the relevant companies and asked for their cooperation, including guidance to customers.
October 22: Consulted the police.

3. Scope of Impact

・Affected service: Onamae.com Desktop Cloud (all plans)
・Number of servers potentially affected: 26,739
・Information potentially affected: Information stored on the servers (including trading account login information saved in trading tools)

*Note: We do not store customers' payment information (including credit card information) on the Service's servers.

4. Our Response

・Server suspension continues on all plans.
・Together with an external cybersecurity firm, we are investigating the intrusion route and the scope of impact.
・We are working with the relevant companies to confirm the damage and prevent it from spreading.
・Please beware of phishing emails, suspicious communications, and fraudulent websites that exploit this incident. We will never ask customers for passwords or credit card information by email or phone.

5. Contact for Inquiries

Contact form: https://help.onamae.com/contact/
Phone: +81-3-5456-2560

6. Future Updates

・The date for resuming the Service has not yet been determined. We will announce it once it is confirmed and safety has been verified.
・We will provide further updates as new information becomes available.

We once again sincerely apologize for the significant inconvenience and concern this incident has caused our customers.