MediumII Cyber Warfare & Critical Infrastructure2 November 2026, Monday
GMO chief admits ignoring internal warning, leaving the bill on its books
GMO Internet Group chief executive Masatoshi Kumagai held his first press conference on 2 November, 12 days after the attack was disclosed. Kumagai admitted the company had been warned internally about a weakness in its systems but had not acted; it will not pay a demand of about 80 billion yen.
According to Advertimes, the attack was detected through a customer inquiry on 19 October, and on 20 October the company confirmed that malware had been planted on some servers. As many as 26,739 servers may have been affected, and login credentials for securities and foreign exchange accounts stored on them may have been stolen and used. The company received an email from the suspected attacker demanding about 80 billion yen.
AP reported more than 26,000 cases and dozens of affected brokerages. Kumagai is forgoing 30% of his salary for 3 months. On 24 October the company said it would pay every customer 5,000 yen and cover losses from unauthorised trades, and on 27 October it announced additional payments of up to 3 million yen per publication for customers whose data had been posted. Its hotline had received 428 reports by the evening of 30 October.
On insurability, neither of the 2 sources reviewed says a cyber policy is covering the compensation; the cover position could not be verified. The flat 5,000 yen payment and the 3 million yen cap per publication show the cost is being held on the company's balance sheet for now. The shares have lost 17.5% since the start of the year. The chief executive's admission on 2 November that a known internal warning was ignored could open a debate among insurers over negligence exclusions.
Talay assessment
Bottom line
The admitted internal warning turns the incident from a story about an external attack into one about governance. Compensation caps and the refusal of the 80 billion yen demand show the cost is staying with the company. The most likely second-order effect is a tightening of known-vulnerability and negligence exclusions in Japanese cyber policies.
Likely effects
- Cyber insuranceNegative1–6 months
A vulnerability that was known but left open gives insurers grounds to tighten security audits and negligence exclusions at renewal.
- Japanese brokeragesNegativeWeeks
Dozens of brokerages relying on the shared infrastructure will have to step up supplier audits, raising compliance costs.
- Japanese cyber policyUncertain1–6 months
Governance and disclosure requirements could be added to the strengthening package promised by the Takaichi government.
Possibilities, ranked
- 1Cost stays with the company55%
GMO pays compensation from its own resources, no insurance contribution is disclosed and pressure on the shares persists.
Watch: An extraordinary loss line in GMO's quarterly report
- 2Regulatory sanction30%
The financial regulator issues improvement orders to the brokerages and to GMO.
Watch: A business improvement order announced by Japan's Financial Services Agency
- 3Attacker is identified15%
The hotline or the police identify the attackers and a debate over state links opens.
Watch: A statement on suspects from the National Police Agency
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Servers affected▼ 26,739
- Ransom demand▼ ~¥80bn
- GMO shares, YTD▼ −17.5%