# Japan Cyberattack Fallout: GMO Offers ¥5,000 to Users as Park24 Faces Breach Costs

- Link: https://tectonicsmediapublications.com/japan-cyberattacks-gmo-compensation-park24-data-breach-october-26-2026/
- Published: 2026-10-26T07:02:09+00:00
- Author: News Team

**TOKYO, October 26, 2026** — Two Japanese companies are putting a price on the 
consequences of cyber intrusions, but their incidents are distinct. Internet infrastructure
provider GMO Internet has promised a ¥5,000 goodwill payment to customers of its
compromised Onamae.com Desktop Cloud service and compensation for verified losses
from unauthorized trades. Separately, car-sharing operator Park24 has announced 
payments to affected customers after a breach of its Times Car system.

The response matters beyond the headline payments: customers need to know which 
losses are covered, how to protect accounts and which facts remain unconfirmed. 
[Reuters reported on October 26](https://www.reuters.com/business/finance/japan-companies-compensate-users-cyberattacks-buffet-economy-2026-10-26/)
that the incidents have heightened concern about the economic cost of cybersecurity
failures in Japan.

## What GMO has confirmed — and what customers can claim

In its [October 24 incident update](https://internet.gmo/en/news/article/249/), 
GMO Internet said investigators confirmed unauthorized access to the Onamae.com 
Desktop Cloud environment, security weaknesses in that service and the removal of
customer information. Some users reported trading activity they did not authorize.
The affected product provides remote computing environments used by customers running
foreign-exchange trading software; this is not a claim that every GMO product was
breached.

GMO says every current customer of the affected service will receive ¥5,000, regardless
of whether a monetary loss occurred. It separately promises to compensate **realized
losses from trades it verifies were unauthorized and caused by the intrusion**, 
including relevant trading losses and fees. Market movements, hypothetical missed
profits and other indirect losses are excluded under its stated policy. GMO says
it will notify eligible customers of goodwill-payment arrangements by October 30
and publish claim procedures for trading losses by November 6.

The company also says it received a demand for money from a party believed to be
the attacker, accompanied by threats to publish information. GMO says it will not
pay and is working with police. These statements describe the company’s account 
of the investigation; the attacker’s identity and full financial damage have not
been independently established.

## What affected customers should do now

GMO’s [fifth official notice, dated October 24](https://internet.gmo/en/news/article/250/),
asks customers to scan their own devices and back up important files. Customers 
who used the service for trading should change trading and platform passwords from
a separate trusted device, terminate existing sessions with their broker, inspect
account balances and trading history, and enable two-factor authentication where
available. If trades are unfamiliar, the company says to contact the broker first
and preserve transaction evidence for a possible claim.

Customers should not follow links or open attachments from anyone claiming to be
the attacker. They should also independently navigate to GMO’s official notices 
rather than trust unsolicited compensation messages. A password change alone may
not invalidate an already-open trading session, which is why GMO explicitly advises
session termination.

## Park24: a separate car-sharing data breach

Park24, operator of Times Car, said in an [October 23 company update](https://www.park24.co.jp/news/2026/10/20261023-1.html)
that unauthorized access affected customer information. Reuters reports the company
plans ¥3,000 payments to customers and expects an extraordinary charge of about 
¥5.5 billion for its incident response and compensation. Park24 has also said it
will change its handling of identity-document images, including ending retention
after verification.

These are **two separate security incidents**. No evidence reviewed for this article
establishes that the same attackers were involved or that a specific recently disclosed
PHP vulnerability caused either breach. Park24 customers should consult the company’s
own notification and avoid messages seeking passwords, verification codes or payment-
card details.

## Why Japan’s cybersecurity response is under scrutiny

Japan has announced plans for a team that uses AI to simulate attacks and identify
vulnerabilities. This comes as other organizations rush to address critical PHP 
flaws and as security providers report rising attack attempts. The broader security
emergency provides context, but it should not be confused with a forensic determination
of how GMO or Park24 was compromised. Read our earlier report on [Japan’s AI cyber-defense plan and PHP-related service disruption](https://tectonicsmediapublications.com/japan-ai-cyber-defense-php-softbank-disaster-alerts-october-2026/).

For companies, the financial issue is not merely the direct cost of a breach. Compensation,
investigations, remediation, service interruptions and lost customer trust can all
outlast the original intrusion. For customers, the most consequential question is
whether they can secure accounts quickly and document eligible losses before deadlines.

## Watch: Japanese broadcaster’s report on GMO’s compensation announcement

[Watch the approximately two-minute authorized ABEMA news report (Japanese-language)](https://abema.tv/video/episode/89-44_s0_p542648)
about GMO’s October 24 announcement of compensation for unauthorized trading and
its request for government cyber-defense measures. This is coverage of the GMO announcement,**
not** footage of the intrusions or Park24’s separate breach. No iframe is embedded
because independent player, regional-access and embedding checks were not completed.

_Featured image: The GMO office lobby in Shibuya, Tokyo, photographed in December
2019. Archival documentary photography; it does not show the 2026 cyberattack or
its investigation. Photo: [Wpcpey / Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Fukuras_GMO_Office_lobby_2019.jpg),
[CC BY 4.0](https://creativecommons.org/licenses/by/4.0/). Image resized for publication;
no substantive alterations._

## Sources and verification

 * [GMO Internet: compensation and investigation notice, October 24, 2026](https://internet.gmo/en/news/article/249/)
 * [GMO Internet: urgent customer-protection steps, October 24, 2026](https://internet.gmo/en/news/article/250)
 * [Park24: investigation and customer response, October 23, 2026](https://www.park24.co.jp/news/2026/10/20261023-1.html)
 * [Reuters: Japan’s corporate compensation responses, October 26, 2026](https://www.reuters.com/business/finance/japan-companies-compensate-users-cyberattacks-buffet-economy-2026-10-26/)

_Reporting status: information verified against the linked sources as of October
26, 2026, 08:00 Central European Time. Payment procedures and the investigations
may change; follow the companies’ official channels for updates._

Please follow and like us:

[[

[ ⌊fb-share-icon⌉](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ftectonicsmediapublications.com%2Fjapan-cyberattacks-gmo-compensation-park24-data-breach-october-26-2026%2F)

[ ⌊Tweet⌉ ](https://x.com/intent/post?text=Japan+Cyberattack+Fallout%3A+GMO+Offers+%C2%A55%2C000+to+Users+as+Park24+Faces+Breach+Costs%20https%3A%2F%2Ftectonicsmediapublications.com%2Fjapan-cyberattacks-gmo-compensation-park24-data-breach-october-26-2026%2F)

[⌊Pin Share⌉⌊Pin Share⌉[

 Share via:

 *  [   Facebook  ](https://tectonicsmediapublications.com/japan-cyberattacks-gmo-compensation-park24-data-breach-october-26-2026/#)
 *  [   X (Twitter)  ](https://tectonicsmediapublications.com/japan-cyberattacks-gmo-compensation-park24-data-breach-october-26-2026/#)
 *  [   LinkedIn  ](https://tectonicsmediapublications.com/japan-cyberattacks-gmo-compensation-park24-data-breach-october-26-2026/#)
 *  [    More   ](https://tectonicsmediapublications.com/japan-cyberattacks-gmo-compensation-park24-data-breach-october-26-2026/#)