MediumII Cyber Warfare & Critical Infrastructure24 October 2026, Saturday
GMO rejects ransom and asks Tokyo for active cyber defence
On 24 October GMO Internet urged the government to apply the active cyber defence law, in force since 1 October, after a breach of its automated FX trading servers. Up to 26,739 servers may be affected; the company refused the attacker's demand for money.
Impress Watch reports that the attack was detected on 20 October. It targeted virtual servers rented for automated FX trading through the 'Onamae.com Desktop Cloud' service. The attackers may have stolen users' brokerage login credentials and carried out unauthorised trades. In its fourth statement on 24 October, the company said the attacker demanded money. The threat was to leak data, deploy ransomware and keep manipulating orders at more than 70 brokers in Japan and abroad.
Jiji says GMO will cover losses and fees from the unauthorised trades; the claims procedure will be emailed to users by 6 November. Every user will receive a 5,000 yen goodwill payment and 6 months of free service, whether or not they suffered losses. The total payout and the number of users were not disclosed, and the sum the attacker demanded could not be verified.
Active cyber defence is the regime, in force since 1 October 2026, that allows the state to access and neutralise attack servers. GMO asked for its case to become the law's 'first application', arguing that organised cybercrime cannot be stopped by private-sector defences alone. Nikkei Asia reported GMO's request the same day as an urgent appeal to the government. It came in the company's fourth update, 4 days after the attack was detected.
Talay assessment
Bottom line
GMO's request will put Japan's active cyber defence powers, in force since 1 October, to their first test in a private-sector case. Because the attack threatens order manipulation at more than 70 brokers, it is a financial-infrastructure risk, not just a data breach. The government's response will show whether the law stays on paper or is actually used against attack servers.
Likely effects
- Japanese financial infrastructureNegativeWeeks
Trades placed in brokerage accounts with stolen credentials raise trust and oversight costs across the retail FX channel.
- Cyber defence policyUncertain1–6 months
A first use of the law would set a precedent for state action against attack infrastructure; inaction would erode private-sector trust in the state.
- Cloud and hosting sectorNegative1–6 months
The exposure of 26,739 servers and the 5,000 yen payout will push up insurance and security spending at Japanese hosting firms.
Possibilities, ranked
- 1Government offers limited support55%
Police investigate and provide technical help, but no server takedown under the law is publicly announced.
Watch: Statement from the National Police Agency or the Cabinet cybersecurity office
- 2First real use of the law30%
The government announces it has used active defence powers against the attack servers, and the case sets a precedent.
Watch: Official confirmation that active cyber defence has been applied
- 3Attacker leaks the data15%
With no payment made, user and company data are published and fresh unauthorised trades appear at brokers.
Watch: GMO data on leak sites, or new warnings from brokers
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Servers potentially affected▼ 26,739
- Payment per user▼ 5,000 yen
- Brokers under threat▼ 70+