Japanese firms compensate customers after cyberattacks

By Rebecca Stone

GMO Internet Group will pay ¥5,000 to every current customer of Onamae.com Desktop Cloud after a cyberattack disrupted the service and enabled unauthorised trading activity. The flat goodwill payment, worth roughly $32, requires no proof of direct financial loss. GMO also offered affected customers a free six-month alternative Windows desktop service on separate cloud infrastructure. The company separately promised reimbursement for confirmed realised losses tied to unauthorised activity in customer trading accounts.

What did GMO promise after the attack?

GMO began investigating on October 19 after customer inquiries. On October 20, it confirmed malicious software in some customer environments. The company suspended new applications and control-panel access before progressively shutting down servers. It later said customer information had been taken outside its systems. Some users reported transactions in their trading accounts that they did not recognise.

The service lets customers operate remote Windows environments, including connections to securities and foreign-exchange (currency) trading accounts. Under the reimbursement terms, GMO will cover trading losses and related fees associated with unauthorised transactions, but exclude losses caused by market movements or profits customers believe they might otherwise have earned. GMO plans to overhaul the service's security architecture and conduct a detailed investigation with external experts. The company also said it is cooperating with police and government agencies.

Suspected attackers demanded money and threatened to disclose company and customer information. Chief Executive Masatoshi Kumagai said: "The ransom demand was equivalent to about $50 million in cryptocurrency." GMO refused to pay. It asked Japanese authorities to consider stronger measures against active attackers. GMO also offered technical evidence from the incident. Its shares fell sharply after details emerged and reached a four-month low.

What did Park24 disclose?

Park24, which operates the Times car-sharing service, will pay ¥3,000 to customers after a separate personal-data breach. Park24 expects extraordinary costs of about ¥5.5 billion linked to the incident, while the breach reportedly affected personal information associated with millions of customer accounts.

Japanese authorities have already warned companies and government bodies to strengthen security after a sharp rise in incidents. Japan recorded 723 cybersecurity incidents by October 20, according to Reuters data cited in the report. The total by October 20 had already exceeded the annual totals recorded in both 2024 and 2025.

How are automated attacks changing exposure?

Security experts said artificial intelligence can scan large numbers of systems for weaknesses, create convincing phishing messages and automate substantial portions of attacks against many systems. That does not mean AI caused every breach. It can, however, make established techniques cheaper, faster and easier to scale.

Recent vulnerabilities in PHP, a programming language widely used for websites, contributed to concerns after reports of millions of attempted attacks globally. Government and corporate websites in several countries went temporarily offline while organisations patched vulnerable systems. No confirmed public evidence links the GMO attack directly to those PHP vulnerabilities.

Why do customer payouts raise enterprise costs?

Companies historically focused on restoring systems, investigating breaches and notifying affected users. Direct compensation now adds another cost layer. The wider financial exposure includes:

• Technical recovery work.
• Regulatory penalties.
• Customer payments.
• Legal claims.
• Business interruption costs.
• Reputational damage.

Companies holding financial or personal data face potentially greater consequences when one incident combines unusable services with direct financial claims and lasting reputational damage across customer relationships. Japan's government plans to use artificial intelligence to simulate cyberattacks and identify weaknesses in critical technology systems. That approach treats cybersecurity as an economic-security priority rather than only an IT function.

What should affected organisations and users do?

Organisations and customers should retain records documenting unauthorised transactions, exposed personal data and suspicious activity, then report the issue immediately. Companies may increasingly offer compensation, but eligibility usually depends on confirming that the incident directly caused the loss, making transaction records, account notices and incident reports essential to any claim. GMO requires no proof of direct financial loss for its ¥5,000 payment, but confirmed trading-loss reimbursement requires evidence tying the incident to the loss.