Hackers stole customer data, and unauthorized trades were reported. The Japanese web giant wants Tokyo to use a new cyber defense framework for the first time.
GMO Internet Group logo.
GMO Internet Group suffered a cyberattack on the cloud servers it provides to FX traders, resulting in the theft of customer data and reports of unauthorized trades.
The breach reportedly put up to 26,739 servers at risk, although not all customers necessarily suffered losses. The company will pay every user ¥5,000 (about $30) and separately compensate customers for losses resulting from unauthorized trades.
GMO also said it had received a monetary demand from someone believed to be behind the attack, who threatened to release customer information and other data if the demand was not met. The company stated that it had no intention of complying and would handle the matter in coordination with the police.
Call for Japan's Cyber Defense Framework
GMO has also urgently asked the Japanese government to invoke its new Active Cyber Defense framework in response to the attack. If activated for this incident, this would reportedly be the first use of the framework, which began operating on October 1, 2026.
The framework strengthens public-private cooperation and gives authorities the legal powers to access and neutralize servers used in serious cyberattacks.
Expert Warns of Similar Attacks
On October 23, VLC Security, a Tokyo-based cybersecurity company, held a briefing on a series of cyberattacks that have come to light since September.
Regarding the GMO incident, it warned that similar services could also become targets. Director Makoto Tanase, a former head of the Cybercrime Investigation Division at Japan's National Police Agency, said services accessible using only an ID and password are vulnerable to abuse.
He suggested that customers eager to execute trades quickly may not have been using multi-factor authentication (MFA), which requires multiple methods of identity verification.
The company also emphasized that artificial intelligence is enabling attackers to launch simultaneous, large-scale attacks using multiple techniques.
Addressing social media criticism of companies that suspend services after attacks, it warned that such criticism could play into attackers' hands by increasing pressure on their targets.
At the same time, it stressed that companies can rebuild trust by disclosing information and responding sincerely after an incident.
Risks Flagged by White-Hat Hackers
In a blog post on October 25, GMO Internet Group President Masatoshi Kumagai revealed that the company's in-house white hat hackers had previously identified "issues that needed to be addressed" in its system security.
He wrote: "Those feeling the deepest frustration are [GMO's] white hat hackers on the front lines who detected the danger and issued warnings, as well as the engineering team that was unable to prevent the attack completely."
Kumagai also explained that the flat ¥5,000 payment was an initial gesture of goodwill toward customers who had experienced "inconvenience and concern" and denied that it was intended to put the matter to rest.
He said the internet was "on the verge of breaking down" and strongly called on the public and private sectors to work together to protect it.
Author: The Sankei Shimbun