[Important] Current Response to Unauthorized Access to “Onamae.com Desktop Cloud” (Eighth Report)

October 27, 2026

Internet Infrastructure

Notice [Important] Current Response to Unauthorized Access to “Onamae.com Desktop Cloud” (Eighth Report)

(Follow-up: What We Are Doing Right Now to Protect Our Customers)

October 27, 2026 (as of 09:58 JST)

* At 10:56 on Tuesday, October 27, 2026, parts of the main text were added and corrected.

Added:
2. Offers of Cooperation from Private Companies
We have listed Trend Micro Incorporated as one of the companies providing cooperation.

Corrected:
3. Request to Power Off Customers’ PCs

We once again sincerely apologize for the great inconvenience and concern that the unauthorized access to “Onamae.com Desktop Cloud” has caused our customers.

We have received a notice from persons believed to be the attackers stating that, at 12:00 on Tuesday, October 27, they will publish customers’ information and carry out a ransomware attack. In order to protect our customers as much as we can, following the Seventh Report, we are informing you of the current status of our efforts.

We have judged that explaining the situation to our customers should be our top priority, and we are providing this information to the extent that we are able to disclose it.

1. We are continuing to analyze customers’ devices

When we asked for customers’ cooperation with the investigation on October 25, we received offers of cooperation from customers across the country. Our partners (employees) have visited customers across the country and taken custody of their devices. We sincerely thank the customers who cooperated.

The devices we have received are being investigated and analyzed in turn by the white-hat hacker team of the GMO Internet Group. We are continuing our analysis, aiming to confirm the extent of the damage, including whether malware (including ransomware) has actually been planted, and to find a way to deal with it.

Devices provided by customers who have cooperated with us are still expected to arrive. We will proceed with the analysis as soon as they arrive.

2. Offers of Cooperation from Private Companies (Updated at 10:56 on October 27: Information on private companies added)

In responding to this matter, we have received offers of cooperation from security companies such as Trend Micro Incorporated, as well as from AI companies and others. In order to make use of each company’s specialized expertise in our investigation and response, we are confirming and coordinating the specific details of their cooperation.

Our Group is grateful for these offers of cooperation, and we will continue to work on responding to our customers and on the investigation and analysis.

3. We will inform you immediately if new facts or countermeasures are identified

If the investigation reveals new facts, or measures that customers should take, we will contact customers who use the Service individually by email and will also announce them on this page.

■ New Requests to Customers in Preparation for the Attack Announced for 12:00

1. Please run a full antivirus scan on your own devices

2. Please back up your data

3. Please disconnect your PC from the network and power it off (Updated at 10:56 on October 27: text corrected)
Before 12:00 on Tuesday, October 27, please back up your data, disconnect from the network, shut down the power, and unplug the cords connected to your PC.

4. Actions to protect your account

Caution: We will never ask you for your password or authentication code. Please do not respond to any communication that asks for payment, such as an offer to “recover your losses.”

For details, click here:
https://internet.gmo/news/article/252/

■ Our Policy

We will not comply with the attackers’ demands. This is because complying with their demands does not guarantee that the information they obtained will be deleted or that its unauthorized use will be prevented. We have consulted the police and other relevant authorities on this matter and are proceeding with our response in cooperation with them.

■ Timeline to Date

・October 21 (Wed): Suspended the Service. Published the first report on the unauthorized access / received a threatening email (demanding approximately 8 billion yen)

・October 22 (Thu): Consulted the police

・October 24 (Sat): Decided on the payment of sympathy payments, compensation for losses, and the provision of alternative services (Fourth Report)
Requested that relevant government agencies apply Active Cyber Defense
Asked customers to take security measures (Fifth Report)

・October 25 (Sun): Asked customers to cooperate with the device investigation

・October 26 (Mon): Reiterated our requests to customers (Sixth Report)
Began analyzing the devices we took custody of (Seventh Report)

・October 27 (Tue): Announced the interim progress of the device analysis and our collaboration with security-related companies (Eighth Report)

■ Contact for Inquiries (Accepted 24 Hours a Day)

・Contact form: https://help.onamae.com/contact/
・Phone: +81-3-5456-2560 (open 24 hours, including weekends and public holidays)

■ Previous Announcements

Report 1: https://www.onamae.com/news/article/11584
Report 2: https://internet.gmo/news/article/247/
Report 3: https://internet.gmo/news/article/248/
Report 4: https://internet.gmo/news/article/249/
Report 5: https://internet.gmo/news/article/250/
Report 6: https://internet.gmo/news/article/252/
Report 7: https://internet.gmo/news/article/253/