Japanese companies pay compensation to users after cyberattacks

Japanese companies have begun paying compensation to users following a wave of cyberattacks that disrupted internet services and raised concerns about economic stability.

Masatoshi Kumagai, CEO of GMO Internet Group (9449.T), a leading provider of online financial services, wrote in a blog post on Sunday that customers will be reimbursed for losses caused by unauthorized access resulting from the attack on the company’s forex trading service. In addition, all customers will receive 5,000 yen ($32) as a goodwill gesture.

“The internet itself is beginning to fall apart,” said the head of the group, whose businesses span internet infrastructure and cryptocurrency trading.

Last week, millions of hacker attacks were recorded after critical vulnerabilities were discovered in the PHP programming language. As a result, government and corporate websites in Japan, Europe and elsewhere became inaccessible.

On Friday, the Japanese government announced that it would set up a group that will use artificial intelligence to simulate cyberattacks and identify weak points in technology systems, as organizations work to reduce the risks stemming from flaws in PHP, which underpins a large part of the internet.

According to experts, artificial intelligence has made cybercrime faster, cheaper and harder to detect by automating tasks ranging from scanning software for vulnerabilities to crafting phishing campaigns.

Kumagai noted: “The internet is increasingly becoming a tool that malicious actors use to threaten and rob people.”

GMO said that a party believed to be behind the attack demanded money from the company and threatened to publish company and customer data if the demand was not met. The company said it would not give in to the demand and would respond to the incident in coordination with the police and other authorities.

GMO will also offer customers a free alternative service for six months. The company said it cannot yet calculate the impact of goodwill payments and loss compensation on its profit. Kumagai wrote that although the “white hat” hackers working at the company identified the security problems, the speed and scope of the response were not sufficient.

As of Friday’s close, GMO shares, with a market value of $2.6 billion, had fallen 15% to a four-month low. On the same day, Tokyo’s benchmark index (.TOPX) rose 0.5%.

Kumagai urged the Japanese government to take active defense measures in response to attacks, referring to the cyber defense system introduced this month. The system may include steps such as attacking hostile servers to neutralize threats.

“Now is the time for the public and private sectors to work together to protect Japan,” he wrote.

The scale of the recent attacks has exposed gaps in Japanese companies’ ability to protect their rich troves of customer data and has increased the likelihood of higher defense spending.

“Companies already have standard security measures in place, so if they want to strengthen them further, the additional cost burden could be quite significant,” said Shoichi Arisawa, an analyst at IwaiCosmo Securities.

According to TrendAI, 723 cybersecurity incidents were recorded in the year to October 20, exceeding the full-year totals for both 2025 and 2024.

Satoshi Nagano, president of cybersecurity firm ESET Japan, noted that the reports may reflect both the growing threats facing organizations and greater attention to incidents that were previously undetected, under-investigated or undisclosed.

Park24 (4666.T), which operates the Times car-sharing service, announced on Friday that it will pay customers 3,000 yen following a leak of personal data. The company also said it will not retain ID document images once registration verification is complete, and that it will book an extraordinary loss of 5.5 billion yen due to its response to the attack and compensation payments.

($1 = 156.81 yen)