GMO hack: 11 weeks undetected, and Remote Desktop opened customers’ PCs
Do you connect to a server or a remote workstation with Windows Remote Desktop? By default, it’s often set to share your local drives with the remote machine. That’s handy for copying a file. In Japan, it’s also how attackers stole files directly from the computers of a major hosting provider’s customers.
On November 2, 2026, GMO Internet Group explained at a press conference how its Onamae.com Desktop Cloud virtual private server (VPS) service was hacked. The intruder went undetected for about 11 weeks, and up to 26,739 servers may be affected.
Remote Desktop and VPS: the timeline of the hack
Onamae.com Desktop Cloud, from an ignored warning to a crisis
April 2024
An internal warning
Experts at GMO Cybersecurity by Ierae, a company in the same group, flag security problems. Four rounds of emergency maintenance follow, which prove insufficient.
Aug. 5, 2026
First server breached
The attacker compromises a customer’s VPS.
Aug. 17
The management server falls
By abusing administrator privileges, the attacker reaches a GMO management server that controls other customers’ VPSs.
Sept. 20 to Oct. 14
Malware distributed
From that server, malware is pushed to other customers’ VPSs.
Oct. 19 and 20
Finally detected
After a customer’s question, GMO notices the anomaly on October 20. The service is suspended the next day.
Nov. 2
Public explanation
GMO confirms that files were stolen from customers’ own computers, through the Remote Desktop connection.
The attacker claims to hold confidential data and browsing histories, and threatens to send them to the victims’ friends and family. “We failed to turn off this setting despite the increasingly severe security environment. Our risk analysis was inadequate,” admitted GMO Internet vice president Hirofumi Yamashita.
How the files left customers’ PCs
The most instructive part for an SMB isn’t the hacked server, but the path to the workstations:
🖥️
1. A customer VPS
Initial entry point, August 5.
🔑
2. Admin privileges
Access to the host’s management server.
📦
3. Malware on other VPSs
Distributed to other customers for almost a month.
🔌
4. RDP drive sharing
Enabled by default: the customer PC’s drives are visible from the VPS.
📂
5. Files stolen
The malware reads files on the customer’s computer, at home or at the office.
In other words, when Remote Desktop shares your drives, the remote machine can read your local files for the whole session. If that machine is compromised, so are your files.
What we know, and what we don’t yet
✔️ What we know
- The intrusion lasted from August 5 to October 20, 2026, about 11 weeks.
- Up to 26,739 servers may have been affected.
- Remote Desktop drive sharing allowed files to be stolen from customers’ PCs.
- Security problems had been flagged as early as April 2024.
❓ What we don’t know
- The exact number of customers whose files were stolen.
- How the attacker got into the first VPS.
- Exactly which data was taken, and how it is really being used.
- Whether other GMO services are involved: the investigation continues.
Your Remote Desktop: a 5-minute self-assessment
Not a GMO customer? The same settings exist in your business as soon as someone connects to a server, a VPS or an office workstation remotely. Score yourself:
Fewer than 4 “Yes”? Time to act. Remote Desktop isn’t the only tool involved: we covered a related case with hijacked remote access software. And if you rely on a hosting provider, here are the questions to ask them.
Three lessons for SMBs
What the GMO hack teaches
⏳ An unfixed warning is still an open door
The problems flagged in April 2024 were never fully resolved. Every finding must be tracked until it’s completely fixed.
👀 Fast detection changes everything
The intruder had two and a half months to move around. Alerts checked by a person cut that delay to hours.
🔌 A handy setting can become a bridge
Drive sharing linked hacked servers to customers’ PCs. Turn off by default whatever isn’t essential.
How NeoTech can help
We review your remote access: Remote Desktop settings through Group Policy, closing exposed ports, VPN and two-factor authentication. For your servers and VPSs, our server management service applies patches and follows security notices through to the end, and our automated 24/7 monitoring with on-call technician response flags abnormal connections and new administrator accounts the same day. Evaluating a host or cloud service? Our cloud services and consulting help you ask the right questions.
Book your free cyber check
In 30 minutes, we review together how your team connects remotely, which settings are on and who would be alerted if a server were hacked tonight.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- The Asahi Shimbun — GMO missed cyberattack for 11 weeks; files of customers stolen, November 3, 2026
- Kyodo News — coverage of GMO’s November 2, 2026 press conference
- Associated Press — coverage of the GMO hack
- GMO Internet Group — investor notice, October 23, 2026 (PDF)
Photo: panumas nikhomkhai, Pexels (Pexels licence).