Japan Cyberattack Fallout: GMO Offers ¥5,000 to Users as Park24 Faces Breach Costs

TOKYO, October 26, 2026 — Two Japanese companies are putting a price on the consequences of cyber intrusions, but their incidents are distinct. Internet infrastructure provider GMO Internet has promised a ¥5,000 goodwill payment to customers of its compromised Onamae.com Desktop Cloud service and compensation for verified losses from unauthorized trades. Separately, car-sharing operator Park24 has announced payments to affected customers after a breach of its Times Car system.

The response matters beyond the headline payments: customers need to know which losses are covered, how to protect accounts and which facts remain unconfirmed. Reuters reported on October 26 that the incidents have heightened concern about the economic cost of cybersecurity failures in Japan.

What GMO has confirmed — and what customers can claim

In its October 24 incident update, GMO Internet said investigators confirmed unauthorized access to the Onamae.com Desktop Cloud environment, security weaknesses in that service and the removal of customer information. Some users reported trading activity they did not authorize. The affected product provides remote computing environments used by customers running foreign-exchange trading software; this is not a claim that every GMO product was breached.

GMO says every current customer of the affected service will receive ¥5,000, regardless of whether a monetary loss occurred. It separately promises to compensate realized losses from trades it verifies were unauthorized and caused by the intrusion, including relevant trading losses and fees. Market movements, hypothetical missed profits and other indirect losses are excluded under its stated policy. GMO says it will notify eligible customers of goodwill-payment arrangements by October 30 and publish claim procedures for trading losses by November 6.

The company also says it received a demand for money from a party believed to be the attacker, accompanied by threats to publish information. GMO says it will not pay and is working with police. These statements describe the company’s account of the investigation; the attacker’s identity and full financial damage have not been independently established.

What affected customers should do now

GMO’s fifth official notice, dated October 24, asks customers to scan their own devices and back up important files. Customers who used the service for trading should change trading and platform passwords from a separate trusted device, terminate existing sessions with their broker, inspect account balances and trading history, and enable two-factor authentication where available. If trades are unfamiliar, the company says to contact the broker first and preserve transaction evidence for a possible claim.

Customers should not follow links or open attachments from anyone claiming to be the attacker. They should also independently navigate to GMO’s official notices rather than trust unsolicited compensation messages. A password change alone may not invalidate an already-open trading session, which is why GMO explicitly advises session termination.

Park24: a separate car-sharing data breach

Park24, operator of Times Car, said in an October 23 company update that unauthorized access affected customer information. Reuters reports the company plans ¥3,000 payments to customers and expects an extraordinary charge of about ¥5.5 billion for its incident response and compensation. Park24 has also said it will change its handling of identity-document images, including ending retention after verification.

These are two separate security incidents. No evidence reviewed for this article establishes that the same attackers were involved or that a specific recently disclosed PHP vulnerability caused either breach. Park24 customers should consult the company’s own notification and avoid messages seeking passwords, verification codes or payment-card details.

Why Japan’s cybersecurity response is under scrutiny

Japan has announced plans for a team that uses AI to simulate attacks and identify vulnerabilities. This comes as other organizations rush to address critical PHP flaws and as security providers report rising attack attempts. The broader security emergency provides context, but it should not be confused with a forensic determination of how GMO or Park24 was compromised. Read our earlier report on Japan’s AI cyber-defense plan and PHP-related service disruption.

For companies, the financial issue is not merely the direct cost of a breach. Compensation, investigations, remediation, service interruptions and lost customer trust can all outlast the original intrusion. For customers, the most consequential question is whether they can secure accounts quickly and document eligible losses before deadlines.

Watch: Japanese broadcaster’s report on GMO’s compensation announcement

Watch the approximately two-minute authorized ABEMA news report (Japanese-language) about GMO’s October 24 announcement of compensation for unauthorized trading and its request for government cyber-defense measures. This is coverage of the GMO announcement, not footage of the intrusions or Park24’s separate breach. No iframe is embedded because independent player, regional-access and embedding checks were not completed.

Featured image: The GMO office lobby in Shibuya, Tokyo, photographed in December 2019. Archival documentary photography; it does not show the 2026 cyberattack or its investigation. Photo: Wpcpey / Wikimedia Commons, CC BY 4.0. Image resized for publication; no substantive alterations.

Sources and verification

Reporting status: information verified against the linked sources as of October 26, 2026, 08:00 Central European Time. Payment procedures and the investigations may change; follow the companies’ official channels for updates.

Please follow and like us: