MediumII Cyber Warfare & Critical Infrastructure29 October 2026, Thursday

Tokyo asks carriers to block the GMO attacker's website

On 27 October the Ministry of Internal Affairs and Communications sent a written request to 4 telecoms associations asking them to block a website run by the GMO attacker; the request became public on 29 October. Carriers have not said whether they have applied the block.

Location: TOKYO

Yomiuri reported on 29 October that the ministry delivered the request in writing on 27 October to 4 industry bodies, including the Telecommunications Carriers Association, whose members include NTT and KDDI. The rationale was the risk of secondary damage spreading through misuse of leaked data. Blocking, in which a carrier cuts access to a given address at network level, requires inspecting the destination of every user's traffic. Because Article 21 of the constitution guarantees the secrecy of communications, Japan very rarely takes this step. An advisory panel to the ministry recommended in July that milder measures be tried first.

The request followed the attacker's publication on 27 October of personal data that appeared to belong to 1 individual. The site's domain was suspended at around 04:00 on 28 October by a US registrar, at GMO's request. Chief Cabinet Secretary Minoru Kihara said on 29 October that the government was in contact with carriers but gave no details. An executive at a major carrier said the decision to comply was a difficult one.

In its 15th statement the same day, GMO said it had obtained strong information that could lead to the perpetrator's identity and would pass it to police. A 1 million dollar reward site launched on 28 October had received 270 tips by 11:30 on 29 October. The attacker demanded about 8 billion yen on 21 October. The credit market is pricing the cost. Data cited by TokenPost show the spread on GMO's June 2031 yen bond widening from 122 basis points on 20 October to 174 basis points on 28 October.

Talay assessment

Bottom line

Tokyo is trying to deploy against a private company's attacker a blocking tool it almost never uses because of communications secrecy. Since the domain was already suspended on 28 October, the request's practical effect is limited. Its real significance is that the state is lowering its threshold for network-level intervention in a cyber crisis. The most likely path is quiet partial compliance and the issue being folded into Takaichi's emergency package.

Likely effects

Telecoms carriersNegativeWeeks
A request with a weak legal basis forces carriers such as NTT and KDDI to choose between constitutional secrecy and state demands; compliance would create litigation risk.
Corporate creditNegative1–6 months
The 52 basis point widening in GMO's bond spread over 8 days shows cyber damage feeding straight into the balance sheet and borrowing costs.
Cyber governanceUncertain1–6 months
The blocking request shows the state seeking new tools for corporate crises that fall outside the active cyber defence framework in force since 1 October.

Possibilities, ranked

1
Partial compliance, folded into a package55%
Carriers act quietly, and the government writes blocking criteria into its emergency cyber package.
Watch: A blocking or network intervention clause in the emergency cyber package Takaichi is due to announce by the weekend
2
Carriers refuse30%
Privacy concerns mean the block is not applied, and the request stands as a contested precedent.
Watch: A public response from the Telecommunications Carriers Association or the major carriers
3
Arrest ends the debate15%
The information GMO gave police leads to an arrest, and the blocking debate loses its urgency.
Watch: A Japanese police announcement of a detention or an international arrest warrant

Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.

Market reaction

Indicators affected

GMO 2031 bond spread▼ +52bp
Tips to reward site▲ 270

Bottom line

Likely effects

Possibilities, ranked

Sources