Tech and AI

GMO Internet asks Japan to use its new active cyber defence powers for the first time after attackers reach up to 26,739 servers used by currency traders

By Staff Writer  |  27 October 2026

The company will pay every user of the service 5,000 yen, compensate losses from unauthorised trades and refuse the attackers' demand for money, its president said.

GMO Internet Group has asked the Japanese government to use its new active cyber defence powers after attackers broke into cloud servers that the company provides to foreign exchange traders. Up to 26,739 servers may have been affected. Customer data was stolen, and some users have reported losses from trades placed on their accounts without their permission.

If the government agrees, it would be the first use of the system, which began operating on 1 October 2026. It gives the authorities legal power to reach and neutralise servers used in serious attacks, with the police and Japan's armed forces able to break into an attacker's server before it does further damage.

Compensation and a demand for money

GMO says it will pay every user of the service 5,000 yen, whether or not they lost money, and will separately compensate customers for losses caused by the unauthorised trades. It has also received a demand for money from someone believed to be behind the attack, with a threat to publish customer information if it is not paid. The company says it will not pay and is dealing with the matter with the police.

In a blog post on 25 October, Masatoshi Kumagai, the group's president, said the company's own white hat hackers had earlier identified problems in the security of the system that needed to be fixed. He described the flat payment as a first gesture to customers for the inconvenience, not an attempt to close the matter.

Those feeling the deepest frustration are [GMO's] white hat hackers on the front lines who detected the danger and issued warnings, as well as the engineering team that was unable to prevent the attack completely.

Masatoshi Kumagai, President, GMO Internet Group

GMO says it will not pay the attackers, and has asked the state to go after their servers instead.

A password was not enough

Kumagai said the internet was close to breaking down and called on government and business to work together to protect it. Makoto Tanase of VLC Security, a former head of the cybercrime investigation division at Japan's National Police Agency, said services that can be reached with only an ID and a password are open to abuse, and suggested that traders keen to place orders quickly may not have used multi-factor authentication.

The request puts a month-old law to its first real test. Whether the government acts on a private company's call will show how far Japan is prepared to go on behalf of a business under attack.