Japanese companies have started paying customers directly after a wave of cyberattacks disrupted services, exposed personal information and caused financial losses.
GMO Internet Group has said it will compensate customers for confirmed losses caused by unauthorised trading following a cyberattack on its cloud service.
It will also pay ¥5,000, or roughly $32, to every current customer of the affected service as a goodwill payment.
Separately, car-sharing operator Park24 has announced ¥3,000 payments to customers following a personal-data breach.
The moves show how cyber incidents are increasingly creating direct financial costs for companies beyond restoring damaged systems.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
GMO Attack Led to Unauthorised Trading
The GMO incident affected its Onamae.com Desktop Cloud service.
The platform allows customers to use remote Windows environments, including for accessing securities and foreign-exchange trading accounts.
GMO began investigating on October 19 after receiving customer inquiries.
A day later, it confirmed that malicious software had been installed in some customer environments.
The company subsequently suspended new applications and access to the service’s control panel before progressively shutting down servers.
GMO later said customer information had been taken outside its systems.
Some users also reported transactions in their trading accounts that they did not recognise.
The company has now promised to reimburse confirmed realised losses linked to unauthorised trading caused by the incident.
That compensation can include trading losses and related fees.
However, losses caused simply by market movements or profits customers believe they might otherwise have earned are not covered.
Every Customer Will Receive ¥5,000
GMO is also offering a flat ¥5,000 payment to every current customer using the affected service.
The company described it as compensation for inconvenience and anxiety caused by the attack.
Customers do not need to prove a direct financial loss to receive that payment.
Those who want to continue using a Windows desktop environment are also being offered an alternative service on separate cloud infrastructure free for six months.
GMO has said it plans to overhaul the security architecture of the affected service and conduct a detailed investigation with external experts.
The company is cooperating with police and government agencies.
Attackers Demanded $50 Million
The company also disclosed that the suspected attackers demanded money and threatened to disclose company and customer information.
Chief Executive Masatoshi Kumagai later said the ransom demand was equivalent to about $50 million in cryptocurrency.
GMO refused to pay.
The company has asked Japanese authorities to consider stronger active cyber-defence measures and has offered to share technical evidence from the attack.
Its shares fell sharply after details of the incident emerged, dropping to a four-month low.
The market reaction shows how cybersecurity failures can quickly move beyond an IT problem and become an investor and business-risk issue.
Park24 Also Offers Customer Payments
GMO is not the only Japanese company compensating users.
Park24, operator of the Times car-sharing service, has said it will pay ¥3,000 to customers following a separate breach involving personal data.
The company expects extraordinary costs of around ¥5.5 billion linked to the incident.
The breach reportedly affected information associated with millions of customer accounts.
Japanese authorities have already warned companies and government bodies to strengthen security following a sharp increase in cyber incidents.
Japan had recorded 723 cybersecurity incidents by October 20, according to data cited by Reuters.
That number had already surpassed the annual totals recorded in both 2024 and 2025.
Cyberattacks Are Becoming More Expensive
The incidents come as companies face attacks that are faster and more automated than before.
Security experts say artificial intelligence can help attackers scan large numbers of systems for weaknesses, create convincing phishing messages and automate parts of an attack.
That does not mean AI is responsible for every breach.
But it can make existing attack techniques cheaper and easier to scale.
Recent vulnerabilities in PHP, a programming language widely used by websites, have added to concerns after millions of attempted attacks were reported globally.
Government and corporate websites in several countries were temporarily taken offline while organisations patched vulnerable systems.
There is currently no confirmed public evidence linking the GMO attack directly to those PHP vulnerabilities.
Compensation Could Become a Bigger Cybersecurity Cost
Historically, companies hit by cyberattacks have focused on restoring systems, investigating the breach and notifying affected users.
Direct customer compensation adds another layer of cost.
If a cyber incident results in financial losses, exposed data or unusable services, companies may increasingly face pressure to reimburse users rather than simply apologise.
That could make cybersecurity failures much more expensive.
The financial impact can include technical recovery costs, regulatory penalties, customer payments, legal claims, business disruption and reputational damage.
For companies holding financial or personal data, the consequences can be even greater.
Japan’s government has also said it plans to use artificial intelligence to simulate cyberattacks and identify weaknesses in critical technology systems.
The broader response suggests cybersecurity is increasingly being treated as an economic-security issue rather than just an IT function.
What this means for you:
If a cyberattack causes unauthorised transactions or exposes your personal data, keep records of suspicious activity and report it immediately. Companies may increasingly offer compensation, but eligibility usually depends on confirming that the loss was directly caused by the breach.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
