[Important] Current Response to Unauthorized Access to “Onamae.com Desktop Cloud” (Ninth Report)

October 27, 2026

Internet Infrastructure

[Important] Current Response to Unauthorized Access to “Onamae.com Desktop Cloud” (Ninth Report)

(Follow-up: Renewed Request to Customers in Preparation for the Attack Announced for 12:00)

October 27, 2026 (as of 11:59 JST)
[Addendum] Due to excessive traffic caused by a surge in access, some of the posting times displayed were incorrect. We have corrected them to the correct times.

We once again sincerely apologize for the great inconvenience and concern that the unauthorized access to “Onamae.com Desktop Cloud” has caused our customers.
We have received a notice from persons believed to be the attackers stating that, at 12:00 on Tuesday, October 27, they will publish customers’ information and carry out a ransomware attack. In order to protect our customers as much as we can, following the Eighth Report, we are informing you of the current status of our efforts.
We have judged that explaining the situation to our customers should be our top priority, and we are providing this information to the extent that we are able to disclose it.

1. Status of the Analysis of Customers’ Devices

The devices we have received are being investigated and analyzed in turn by the white-hat hacker team of the GMO Internet Group. As of [11:59 on October 27], no malware (including ransomware) has been found on the devices for which analysis has been completed.
However, our analysis is still ongoing, and this does not mean that the safety of all customers’ devices has been confirmed. Devices provided by customers who have cooperated with us are still expected to arrive. We will proceed with the analysis as soon as they arrive.

2. Response for Customers Who Have Fallen Victim to Ransomware

Customers who have fallen victim to ransomware are asked to notify our contact point for inquiries. After confirming the status of the damage, we will provide a new PC with performance equivalent to that of the affected PC.

3. Offers of Cooperation from Private Companies

In responding to this matter, we have received offers of cooperation from security companies such as Trend Micro Incorporated, as well as from AI companies and others. In order to make use of each company’s specialized expertise in our investigation and response, we are confirming and coordinating the specific details of their cooperation.

4. We Will Inform You Immediately If New Facts or Countermeasures Are Identified

If the investigation reveals new facts, or measures that customers should take, we will contact customers who use the Service individually by email and will also announce them on this page.

■ Renewed Requests to Customers in Preparation for the Attack Announced for 12:00

1. Please run a full antivirus scan on your own devices

2. Please back up your data

3. Please disconnect your PC from the network and power it off

Before 12:00 on Tuesday, October 27, please back up your data, disconnect from the network, shut down the power, and unplug the cords connected to your PC.

4. Actions to protect your account

Caution: We will never ask you for your password or authentication code. Please do not respond to any communication that asks for payment, such as an offer to “recover your losses.”

For details, click here:
https://internet.gmo/en/news/article/252/

■ Our Policy

We will not comply with the attackers’ demands. This is because complying with their demands does not guarantee that the information they obtained will be deleted or that its unauthorized use will be prevented. We have consulted the police and other relevant authorities on this matter and are proceeding with our response in cooperation with them.

■ Timeline to Date

・October 21 (Wed): Suspended the Service and published the first report on the unauthorized access (4:00) / Received a threatening email (demanding approximately 8 billion yen)
・October 22 (Thu) 13:00: Consulted the police
・October 22, 2026 16:59 [Important] Notice and Apology Regarding Unauthorized Access to “Onamae.com Desktop Cloud” (Second Report)
・As of 11:50 on October 24, 2026: Regarding Payment of Sympathy Payments to Customers and Compensation for Losses from Unauthorized Transactions ~ Began Requesting Relevant Government Agencies to Implement Measures Related to Active Cyber Defense ~ (Fourth Report)
・October 24 (Sat) 15:00: Decided on the payment of sympathy payments, compensation for losses, and the provision of alternative services (11:50 / Fourth Report)
・October 24 (Sat) 15:00: Requested that relevant government agencies apply Active Cyber Defense; Request for security measures (Fifth Report)
・October 25 (Sun): Asked customers to cooperate with the device investigation
・October 26 (Mon) 21:00: Reiterated our requests to customers (Sixth Report). Began analyzing the devices we took custody of (Seventh Report)
・October 27 (Tue) 9:58: Announced the interim progress of the device analysis and the offers of cooperation from private companies, and asked customers to power off their PCs in preparation for the announcement for 12:00 (Eighth Report)
・October 27 (Tue) 11:59: Announced the status of the device analysis and our renewed requests (Ninth Report)

■ Contact for Inquiries (Accepted 24 Hours a Day)

・Contact form: https://help.onamae.com/contact/
・Phone: +81-3-5456-2560 (open 24 hours, including weekends and public holidays)

■ Previous Announcements

Report 1: https://www.onamae.com/news/article/11584
Report 2: https://internet.gmo/en/news/article/247/
Report 3: https://internet.gmo/en/news/article/248/
Report 4: https://internet.gmo/en/news/article/249/
Report 5: https://internet.gmo/en/news/article/250/
Report 6: https://internet.gmo/en/news/article/252/
Report 7: https://internet.gmo/en/news/article/253/
Report 8: https://internet.gmo/en/news/article/254/