Japanese firms start paying for cyberattacks through customer compensation

The Reuters story carried by Taipei Times says GMO chief executive Masatoshi Kumagai wrote in a Sunday blog post that losses from the unauthorised access would be covered. All customers, he wrote, would receive a goodwill payment of 5,000 yen (32 dollars). The company will provide 6 months of an alternative service free of charge and cannot yet calculate the effect on earnings. GMO said it would not pay a money demand that came with a threat to leak data, and that it has not linked the attack to PHP vulnerabilities. Kumagai acknowledged that white-hat hackers working for the company had reported the problems, but that the response stayed far too slow and too weak.

MLex reports that Park24 disclosed on 23 October that a vulnerability in the Times Car web system had been exploited and 6.6 million accounts affected. About 1.46 million encrypted images of identity documents were taken out of the system, and a further 892,000 were accessed but not exfiltrated. Customers whose records show both access and exfiltration will be paid 3,000 yen in cash or vouchers. Reuters writes that Park24 will stop storing identity images once verification checks are done and expects an extraordinary loss of 5.5 billion yen; that figure could not be verified in the company's stock exchange filings.

NHK reported on 23 October that Economy Minister Akazawa would set up a white-hat hacker team in November. The same day the Health Ministry temporarily shut down 31 systems over the PHP vulnerability, and the Digital Agency said more than 13,000 personal records may have leaked. Japan's active cyber defence law took effect at the start of October.