Hackers hit Japan's Onamae Desktop Cloud, affecting up to 27,000 servers

[Barry1]

A major Japanese hosting service has been breached. BleepingComputer's Bill Toulas reports that hackers broke into Onamae Desktop Cloud, a virtual server service run by GMO Internet, and installed malware on up to 26,739 customer servers

The company confirmed on 20 October that malicious programs had been installed. From 4am local time on 21 October it began shutting down customer servers, and all Desktop Cloud plans are suspended with no date for restarting

The service is marketed for automated foreign exchange trading using MetaTrader 4, so many customers rely on it running constantly. Payment data is stored separately and reportedly unaffected, but data stored on the servers may have been exposed, although no misuse has been confirmed

Customers are being told to change any secrets stored on their servers and to watch for phishing emails. The parent site, Onamae.com, is one of Japan's largest domain registrars, so the incident has drawn a lot of attention

This is the latest in a run of attacks on hosting providers, following FirstVDS and ConnectWise. Attackers are clearly targeting management platforms that reach thousands of customers at once. For customers, an indefinite shutdown is almost as damaging as the breach itself

How would your business cope if its hosting provider shut down indefinitely? And are hosting platforms becoming the weakest link in security?

Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affectedwww.bleepingcomputer.com