Japanese company to compensate users hit by cyberattack
GMO Internet, a Japanese internet infrastructure company, will compensate customers for losses from unauthorised trading linked to a cyberattack on its cloud service, and will make a ¥5,000 (€28) goodwill payment to every customer currently using the affected service.
Published on 26/10/2026 - 12:52 GMT+1
A Japanese internet infrastructure company is compensating customers affected by unauthorised transactions following a cyberattack on its cloud service.
GMO Internet announced on Saturday that it would cover losses from unauthorised trading linked to the attack and issue a ¥5,000 (€28) goodwill payment to all customers currently using the affected service, regardless of whether they had suffered financial losses.
The attack targeted Onamae.com Desktop Cloud, a virtual private server service used by customers to access remote desktop environments. GMO said customer information had been taken and some users had reported transactions in their trading accounts they did not recognise.
According to the company’s founder and CEO, Masatoshi Kumagai, the incident potentially affected 26,739 servers and involved unauthorised operations on trading accounts held with more than 70 securities and foreign-exchange firms in Japan and overseas.
GMO shares fell almost 16% on Monday to a four-month low. The company had a market value of around $2.6 billion at Friday’s close.
The company began investigating on 19 October after receiving a customer inquiry. It confirmed the installation of a malicious programme on some customer server environments on 20 October, suspended new applications and access to the service’s control panel, and began shutting down all servers the following day to prevent further damage.
In a blog post on Sunday, Kumagai apologised for the company’s response and acknowledged that security issues had been identified by its security specialists before the incident, but that the response had been insufficient.
GMO said it had received a ransom demand from a party believed to be behind the attack. In an update to his blog post on Monday, Kumagai said the attackers had demanded $50 million in cryptocurrency and threatened to disclose company and customer information. The company has refused to pay and is cooperating with the police and other authorities.
GMO will offer customers who wish to continue using a Windows desktop environment an alternative service on independent cloud infrastructure, free for six months. It also plans to overhaul its security architecture and investigate the cause of the breach with external experts.
Kumagai has urged the Japanese government to strengthen its active cyberdefence measures, arguing that private companies cannot tackle sophisticated cross-border cyberattacks alone.
GMO has asked the authorities to consider applying the framework to the incident and has offered to share evidence and technical information with investigators.
The attack comes amid wider concerns over cybersecurity following the disclosure last week of two critical vulnerabilities in PHP, a programming language widely used to build websites and applications.
Security authorities warned that the flaws could allow attackers to execute malicious code on vulnerable servers, prompting organisations around the world to patch systems or temporarily take services offline.
However, GMO has not publicly confirmed a link between the PHP vulnerabilities and the attack on its cloud service.
Separately, a Google Cloud outage in the UK disrupted online services last week, including those operated by financial technology company Revolut, showing the potential knock-on effects when digital infrastructure fails.
