GMO Internet compensation: 5,000 yen per user after cyberattack

Key takeaways

• GMO Internet Group will pay a flat 5,000 yen (about $32) to users of its hacked Onamae.com Desktop Cloud service, whether or not they lost money.
• On top of that payment, GMO says it will cover confirmed losses from unauthorized trades in full, even if exchanges refuse to refund them.
• The company says it received a ransom-style threat from the suspected attacker, will not pay, and is working with police.
• Park24, operator of the Times Car sharing service, separately plans a 3,000-yen payment linked to 1,464,800 leaked ID-image records and expects a 5.5 billion yen extraordinary loss.
• The cases add to a record run of cyber incidents in Japan, and Prime Minister Sanae Takaichi says an emergency cybersecurity package is coming.

GMO Internet compensation for the Onamae.com Desktop Cloud cyberattack has two parts: a flat 5,000 yen per customer and full repayment of confirmed unauthorized-trade losses. Chief executive Masatoshi Kumagai set out the plan in a blog post on Oct. 25, 2026.

The payments make GMO the latest Japanese company to compensate customers directly after a cyberattack. Reuters described the trend on Oct. 26 as companies across the country deal with a surge in hacking. Below is what GMO is paying, who qualifies, what Park24 is doing, and why the wave of payouts matters.

GMO Internet compensation: what customers get

The attack hit Onamae.com Desktop Cloud (お名前.com デスクトップクラウド), a virtual private server product run by GMO Internet, a GMO Internet Group subsidiary. According to J-CAST News, many customers used it to run automated foreign exchange trading tools. Reuters described the target as GMO's FX trading service.

The compensation has three parts:

• Goodwill payment: a uniform 5,000 yen for all users of the affected service, regardless of whether they lost money, according to J-CAST News and Reuters.
• Loss compensation: GMO Internet will repay realized losses from unauthorized transactions caused by the intrusion once it has confirmed them. In Kumagai's blog, the company says it will pay the full amount of eligible losses even if exchanges or brokers decline to refund them, as quoted by Sponichi Annex.
• Replacement service: customers will be offered an alternative service on a new, separate platform, free for six months, according to Reuters and J-CAST News.

Kumagai said the 5,000 yen is not meant to close the matter. Japanese outlets including ITmedia and Sponichi Annex describe it as a first step for customers who were inconvenienced, while the confirmed-loss compensation is handled separately.

Who qualifies

Based on the company statements reported so far, any user of the Desktop Cloud service qualifies for the flat payment. Loss compensation applies only to customers whose trading accounts saw unauthorized transactions that GMO can verify. GMO has not published a total loss figure or the number of affected customers. J-CAST News reported that up to 26,739 servers may have been affected. That figure counts servers, not people.

Timeline of the GMO cyberattack

Why GMO refused the attacker's demand

According to Reuters, GMO said it had received a demand from a party believed to be behind the attack, along with a threat to leak company and customer information. GMO said it will not pay and is working with police and other authorities. J-CAST News reported that the company described the messages as "malicious threats" and had consulted the police.

GMO has not given a detailed public reason for refusing beyond saying it is working with the authorities. Paying would also offer no guarantee that stolen data is deleted or kept private. The company has not said whether the attack is linked to the critical PHP vulnerabilities disclosed earlier this month, Reuters noted. For background on that flaw, see our guide to the PHP emergency security patches.

Kumagai also acknowledged a lapse. In-house white-hat hackers had already flagged security issues, he wrote, but the response was not deep or fast enough. In J-CAST's account, he wrote that "the attackers exploited that gap." Reuters reported that he also urged the government to make use of a new active cyberdefense system introduced this month, including measures such as attacking hostile servers.

Market reaction

The company's shares fell almost 16% to a four-month low on Friday, Oct. 23, according to Reuters. Tokyo's benchmark index rose 0.2% the same day. Reuters put GMO's market value at about $2.6 billion at Friday's close. GMO said it cannot yet estimate how the payments and compensation will affect earnings.

Park24 also pays Times Car users after data breach

GMO is not alone. On Oct. 23, Park24, which runs the Times Car sharing service, said it would make a goodwill payment worth 3,000 yen, in cash or vouchers, according to ITmedia and Nikkei. The payment is for users whose identity-document images, such as driver's licenses, show traces of being sent outside the company.

Park24 detected the intrusion on Sept. 25. On Sept. 28 it disclosed a leak of about 6.6 million account records, including names, addresses, birth dates, phone numbers, email addresses and driver's license details, according to ITmedia and BleepingComputer. The company says the ID images were encrypted but that it cannot rule out future decryption. That risk is why it chose to pay.

Sources: Reuters, J-CAST News, ITmedia, Nikkei. Dollar conversions by Reuters at 156.81 yen per dollar.

ITmedia reported that Park24 cut its full-year net profit forecast from 44 billion yen to 38.5 billion yen. If each eligible record belongs to a different person, the payments alone would total about 4.4 billion yen. Park24 has not said how the payout will be distributed and plans to contact eligible users individually. MLex has reported that a Japanese lawyer is preparing a joint damages lawsuit over the leak.

Why Japanese companies are compensating customers

The payouts come as the number of cyber incidents in Japan climbs. Reuters, citing data from TrendAI, reported 723 cybersecurity incidents in the year to Oct. 20. That is already more than the full-year totals for 2025 and 2024. Satoshi Nagano, president of ESET Japan, told Reuters the figures may partly reflect better visibility of incidents that would previously have gone undetected or undisclosed.

Capcom has also disclosed a large account breach, covered in our report on the CAPCOM ID data breach. Experts quoted by Reuters say AI tools are automating vulnerability scanning and phishing, which makes attacks faster and cheaper to run.

Policy is moving too. Prime Minister Sanae Takaichi said the government plans to compile an emergency cybersecurity package by sometime next week, according to Reuters. Japan also said on Friday it would set up a team that uses AI to simulate cyberattacks and find weak points in technology systems.

What it means

For customers, the two cases set a visible benchmark. Companies are paying a small flat amount for inconvenience or exposure, and then compensating proven losses separately. GMO's pledge to cover confirmed losses even when exchanges decline refunds is notable, because affected traders would otherwise have to pursue each broker on their own.

For companies, the cost goes beyond the payouts. Shoichi Arisawa of IwaiCosmo Securities told Reuters that strengthening defenses beyond standard measures could carry a substantial additional cost. Park24's 5.5 billion yen charge shows how quickly a single breach can reach a company's bottom line. GMO has yet to put a number on its own bill.

Readers who think their details may have been exposed in either incident can follow the steps in our guide on how to check if your data was breached. For more coverage, see our Japan topic page.