Skip to content
Sign in
Technology · Asia Pacific

GMO offers customers compensation after cyberattack on its trading service

GMO Internet Group said it will compensate customers after unauthorised access to its foreign-exchange service, giving every customer 5,000 yen initially. Japan plans an AI team to test systems as PHP vulnerabilities prompted millions of hacking attempts and disrupted websites.

AI-assisted synthesis · Based on 4 independent reports from 5 outlets · Article text read from 1 of 4 reportsHow it's made

View timeline · 7 entries
5 outletsLatest reporting 3 min read
Coverage: Center OnlyL 0 · C 4 · R 0 · 1 unrated
Updat3 graphic: Japan
Updat3 graphic · Map data: Natural Earth Natural Earth (public domain)

What happened

Key facts

  • GMO Internet Group said it would compensate customers for losses from unauthorised access after a cyberattack on its foreign-exchange trading service.
  • CEO Masatoshi Kumagai said every customer would receive 5,000 yen as an initial gesture of good faith.
  • Japan said it would establish a team to use AI simulations to identify weaknesses in technology systems.
  • GMO shares fell nearly 14 per cent to a four-month low, while Tokyo’s benchmark index rose 0.3 per cent.

The brief

GMO Internet Group said it will compensate customers after unauthorised access to its foreign-exchange trading service. CEO Masatoshi Kumagai said every customer would receive 5,000 yen as an initial payment. CNA reported the company’s announcement and said the access followed a cyberattack on the service.

The compensation addresses losses linked to the unauthorised access, but GMO did not say in the cited account how the company would calculate individual losses. Kumagai made the payment announcement in a blog post, according to CNA. The initial amount is set for every customer, rather than being described as an assessment of each customer’s specific loss.

GMO said it would not comply with the attackers’ demand. The company said it would coordinate its handling of the incident with police and other authorities. The account does not identify the demand’s terms or name the attackers, so their identity and the substance of their request remain unclear. The incident also coincided with a sharp move in GMO’s shares.

The stock fell nearly 14 per cent to a four-month low, while Tokyo’s benchmark index rose 0.3 per cent. CNA reported that GMO had a market value of US$2.6 billion at Friday’s close. These figures describe the market movements alongside the company’s announcement; they do not establish what caused the share-price change.

CNA also reported TrendAI data showing 723 cybersecurity incidents in the year to October 20, a total above the annual counts recorded in 2025 and 2024. The data provides a broader measure of reported incidents, but the account does not connect those incidents to GMO’s breach. Kyodo News’s headline says GMO requested government cyber-defence measures over the breach.

The headline does not provide details of the requested measures. The Indian Express, the420.in and Reuters headlines also describe Japanese companies compensating users, but do not add details about GMO’s customer payments beyond the event itself. For GMO, the next documented steps are its coordination with police and other authorities and the payment to customers.

The company’s stated position is that it will not meet the attackers’ demand while it addresses the incident through those channels.

Why it matters

  • GMO customers are the direct recipients of the stated compensation: each is to receive 5,000 yen initially, while the company says the payment addresses losses linked to unauthorised access.
  • GMO’s shares fell nearly 14 per cent to a four-month low as Tokyo’s benchmark index rose 0.3 per cent; the figures show the different market movements but do not establish a cause.
  • GMO said it would not comply with the attackers’ demand and would coordinate with police and other authorities, placing the company’s handling of the incident alongside its customer compensation.

What to watch next

  • Whether GMO makes the stated initial 5,000-yen payments to every customer.
  • What actions GMO takes in coordination with police and other authorities.
  • Whether GMO maintains its stated refusal to comply with the attackers’ demand.
  • What government cyber-defence measures, if any, follow the request attributed to GMO in Kyodo News’s headline.

How it's being covered

Coverage analysisShow details
6 source articles · 5 unique outlets · 3 distinct reports
Outlet political mix: Center Only· 4 Center · 1 unrated
Where the outlets are based: Asia 80% · Global 20%
Outlet political mix
Center Only
Left
Center
Right
0 outlets
4 outlets
0 outlets
The marker shows coverage balance: each unique outlet counts once. 1 unrated outlet is not included.
Geography
Where the outlets covering this story are based.
5 unique outletsDominant coverage: Asia
Coverage imbalance
  • Coverage is currently concentrated among Center-rated outlets (4 of 4 rated sources); comparatively few Left or Right-rated outlets have published on the event.
  • Coverage is currently concentrated among outlets based in Asia (4 of 5 geographically-identified sources).
How we measure coverage

One source is from a wire service (AP, Reuters, AFP or Bloomberg), whose reporting other outlets often republish.

How outlets' accounts compare

Updat3 does not yet have enough full reports to compare how outlets framed this story.

Timeline

Developments from this story's sources, dated background we compiled and fact-checked, and our earlier coverage. Each row says which.
  1. Japan enacted the Act on the Protection of Personal Information.
    Background · compiled and fact-checked by Updat3
  2. The government established the National Information Security Center in 2005 to coordinate information-security policy across ministries.
    Background · from our historical context
  3. In September 2011, Mitsubishi Heavy Industries disclosed that its systems had been targeted in a cyberattack; the company said information had been taken from some computers.
    Background · from our historical context
  4. Japan enacted the Basic Act on Cybersecurity.
    Background · compiled and fact-checked by Updat3
  5. Japan established the Cybersecurity Strategic Headquarters.
    Background · compiled and fact-checked by Updat3
  6. Japan's Cabinet adopted a National Security Strategy that called for stronger cyber capabilities.
    Background · compiled and fact-checked by Updat3
  7. In June 2024, a ransomware attack on Japanese publisher Kadokawa disrupted services across its group, including the Niconico video platform, and exposed personal information.
    Background · from our historical context

How we got here

In June 2024, a ransomware attack on Japanese publisher Kadokawa disrupted services across its group, including the Niconico video platform, and exposed personal information. The incident illustrated how an intrusion into a company’s systems could affect both customers and services; it was not the first major cyber incident to confront Japanese organizations.

The government established the National Information Security Center in 2005 to coordinate information-security policy across ministries. The Act on the Protection of Personal Information, enacted in 2003 and substantially amended in 2015, set rules for handling personal data.

Original sources

5 of 6 articles · Asia · Show all

Every story links to the reporting it was built from. How we choose sources

Spotted a factual error, a broken link or a misleading summary? Tell us.