II Cyber Warfare & Critical Infrastructure·Analysis·Asia-Pacific
In Japan, the cyber bill lands on balance sheets, not policies
On 27 October Tokyo made a rare request to block an attacker's website. The quieter number sits elsewhere: GMO's 2031 bond spread widened 52 basis points in eight days, because Japanese policies exclude ransom and often business interruption.
Cyber & Critical Infrastructure Desk · 30 October 2026 · 6 min read · 10 sources
Why it matters
Noise: the state asking telecom operators to block the attacker's site, and an 8 billion yen ransom demand. Signal: the spread on GMO's June 2031 bond rose from 122 to 174 basis points between 20 and 28 October. Japanese policies do not pay ransom and often leave out business interruption; only 8.8% of SMEs are insured. The coverage gap moves cyber risk out of the insurance market and into corporate credit spreads.
Implications
- The spread on GMO's June 2031 yen bond was roughly 122 basis points on 20 October and roughly 174 on 28 October; the shares fell about 16% intraday.
- Japanese insurers exclude ransom paid to attackers; in the General Insurance Association of Japan survey, cyber cover among SMEs fell from 10.0% to 8.8%.
- GMO is paying every customer 5,000 yen and Park24 3,000 yen; one major insurer caps apology payments at 1,000 yen a head, so the company's share stays on the balance sheet.
Noise
The state blocking the attacker's site marks a turning point in the crisis
Signal
The credit market is pricing cyber losses as balance-sheet risk
The noise is the block request; the signal is the bond spread
On 27 October the Ministry of Internal Affairs and Communications wrote to 4 telecom associations, asking them to block a site run by the GMO attacker. The news broke on 29 October and dominated the agenda. Yet a US domain registrar had already suspended the site's domain at around 04:00 on 28 October. As of 29 October the operators had not said whether they applied the block. The request has limited practical effect; the real story is who pays for the attack.
The credit market shows that cost most clearly. According to data cited by TokenPost, the spread on GMO Internet Group's June 2031 yen bond, the extra yield investors demand over government debt, stood at roughly 122 basis points on 20 October. By 28 October it had reached roughly 174 basis points. A 52 basis point widening in eight days shows investors pricing lost earnings and customer compensation. Startup Fortune reports that the shares of the company, worth about $2.6 billion, fell roughly 16% intraday to a four-month low.
What the policy does not pay
The spread widened because of how cover is built. Japan's insurance market is counted as the largest in Asia-Pacific, yet the American Academy of Actuaries' August 2025 guide puts 2022 written cyber premium at only about $200 million. The same guide says Japanese policies typically exclude ransom payments and often leave business interruption uncovered. The General Insurance Association of Japan treats ransom as excluded; Mitsui Sumitomo and Aioi Nissay Dowa also keep money paid to attackers outside cover.
What is covered is narrow: the small apology payment made after a personal data leak. In policy examples compiled by Innovatopia on 22 October, one major insurer caps this at 1,000 yen per person and 50,000 yen per company. GMO is giving every customer of the affected service 5,000 yen plus six months of a free alternative service, five times the sample cap. Park24 is paying 3,000 yen over the Times Car leak and expects an extraordinary loss of 5.5 billion yen. The difference comes out of equity, not out of a policy.
The base is thin too. In the association's August–September 2025 survey, cyber cover among SMEs fell to 8.8%, down from 10.0% in the November 2024 round. Global pricing is moving the other way: the Marsh index shows cyber rates down 4% year on year in the third quarter of 2026, the 13th consecutive quarterly decline. Cheaper policies leave the risk they do not cover on the balance sheet.
State attribution could trigger the exclusion
The second layer of the constraint is attribution. AFP reported on 21 October that GMO's security unit confirmed the use of ARTEX, an AI-assisted penetration testing tool developed in China, in the wave against Japanese companies. The unit identified 6 servers running AI-assisted attacks, with targets broadly grouped into finance, e-commerce and logistics. The AFP report carried by the Taipei Times does not say whether the attacks were state-sponsored; as of 30 October there is no official state attribution.
That gap is decisive for insurance. Since January 2025 Tokio Marine Nichido has added a special clause excluding war and similar events to all its cyber contracts. If Tokyo later ties the wave to a state, insured companies' claims could be reread against the scope of that clause. It could not be verified that this risk has actually been applied to any claim. On 26 October Takaichi said the government would use every option against the attacks, including neutralisation; harder attribution language would also bring the coverage debate forward.
What comes next
The first threshold is the emergency cyber package that Takaichi demanded on 26 October within one week. If it includes SME support or something like a state pool, part of the risk shifts to the public sector. If not, the cost stays on corporate balance sheets. The second threshold is November earnings: GMO says it cannot yet calculate the profit impact of compensation. The leak of 2,585,481 records at So-net, disclosed on 27 October, puts the same question to the Sony group. The signal is whether the spread holds above 174 basis points and spreads to other issuers.
Probabilities
Scenarios
| Scenario | Probability | Trigger | Market impact |
|---|---|---|---|
| H1Losses stay on the balance sheet | 55% | The emergency package leaves the coverage gap untouched and cyber-related extraordinary losses rise in November results. | Credit spreads on Japanese issuers hit by breaches rise durably; demand for policies grows but cover stays narrow. |
| H2The state shares the risk | 30% | Takaichi's package includes SME support or a publicly backed cyber risk mechanism. | Part of the loss moves to the public sector, spreads narrow and SME cover begins to rise. |
| H3Attribution triggers the exclusion | 15% | Tokyo formally ties the wave to a state and insurers raise the war exclusion against claims. | Coverage uncertainty grows, companies lean on their own reserves more than on insurance, and credit spreads jump. |
Module A
Constraints Matrix
STRUCTURAL AVG 3.5 · TACTICAL AVG 2.7Structural constraints dominate: the outcome is set more by these limits than by the actors' preferences.
Hard structural constraintspersistent · beyond the actors' will
Ransom is excluded
4/5The General Insurance Association of Japan treats ransom as excluded; Mitsui Sumitomo and Aioi Nissay Dowa do not cover money paid to attackers. The 8 billion yen demand is not an insurable item.
A thin insurance base · Japan
4/5Written premium in 2022 was about $200 million; SME cover stood at 8.8% in the August–September 2025 survey. Most of the loss falls on equity, not on a policy.
War exclusion
3/5Since January 2025 Tokio Marine Nichido has added a war exclusion to all contracts; an official state attribution could open the scope of claims to dispute.
Secrecy of communications · Japan
3/5Article 21 of the Constitution limits network-level blocking; the state's 27 October request is therefore not binding on operators, and it has not been disclosed whether it was applied.
Tactical frictiontemporary · eases over time
Compensation bill still open weeks
3/5GMO says it cannot yet calculate the profit impact of apology payments and damages; Park24 expects an extraordinary loss of 5.5 billion yen.
Attribution uncertainty weeks
3/5ARTEX is known to have been developed in China, but there is no official statement on whether the attacks were state-sponsored.
Emergency package timetable days
2/5On 26 October Takaichi asked for the package within a week; as of 30 October its contents had not been announced.
Module B
Signal vs Noise
SIGNAL 67% · NOISE 33%
- NOISE
The state blocking the attacker's site marks a turning point in the crisis
The ministry sent its request to 4 associations on 27 October, but the domain had already been suspended at around 04:00 on 28 October; operators have not said whether they acted.
Yomiuri Shimbun (d menu) — Ministry asks operators to block the attacker's site
- SIGNAL
The credit market is pricing cyber losses as balance-sheet risk
The spread on GMO's June 2031 yen bond was roughly 122 basis points on 20 October and roughly 174 on 28 October, a 52 basis point widening in eight days.
TokenPost — GMO Yen Bond Spread Widens 52 Basis Points After Cyberattack
- SIGNAL
Apology payments exceed the policy cap
In one major insurer's example the cap is 1,000 yen per person and 50,000 yen per company; GMO is paying 5,000 yen per customer and Park24 3,000 yen.
Innovatopia — What cyber insurance pays and what it does not
- NOISE
The 8 billion yen ransom demand measures the damage
GMO went to the police on 22 October and refused to pay; the real cost is customer compensation and six months of free alternative service.
Business+IT (Yahoo! News Japan) — Strong leads reach police in GMO attack, 270 tips for reward
- SIGNAL
Global premiums are falling while cover stays narrow
The Marsh index shows cyber rates down 4% year on year in the third quarter of 2026, the 13th straight quarterly fall; SME cover in Japan fell from 10.0% to 8.8%.
Innovatopia — What cyber insurance pays and what it does not
- SIGNAL
Ransom and business interruption sit outside Japanese policies
The Academy of Actuaries guide says Japanese policies typically exclude ransom and often leave business interruption uncovered; 2022 written premium was about $200 million.
American Academy of Actuaries — Global Cyber Insurance Toolkit (August 2025)
Module C
Asset-Class and Positioning Implications
| Asset class | Exposure | Transmission channel | H1 | H2 | H3 | Expected | Conviction | Horizon | What to watch |
|---|---|---|---|---|---|---|---|---|---|
| Credit | Bonds of Japanese companies hit by cyber incidents | Compensation and lost earnings booked against the balance sheet | −− | + | −− | −1.10 | ●●● | 0–3 months | Whether GMO's 2031 bond spread holds above 174 basis points |
| Equities | Japanese cybersecurity services | The emergency package and corporate defence spending | + | ++ | + | +1.30 | ●●● | 3–12 months | Budget lines in Takaichi's emergency cyber package |
| Freight & insurance | Japanese cyber insurance capacity | Narrow cover and war exclusions against rising demand | + | 0 | −− | +0.25 | ●●● | 3–12 months | Cyber policy revisions at the major Japanese insurers |
| Sovereign debt | Extended-maturity Japanese government bonds | The budget cost of publicly backed risk sharing | 0 | − | 0 | −0.30 | ●●● | 12+ months | The 4% threshold on the Japanese 30-year yield |
Second-order effects
And then what?
Starting point
GMO's 2031 bond spread widened 52 basis points between 20 and 28 October; because Japanese policies exclude ransom and cap apology payments as low as 1,000 yen a head, most of the compensation is booked against the company's balance sheet.
- 1
Credit spreadwithin weeks
Other issuers hit by cyber incidents issue profit warnings and book extraordinary losses; credit investors start pricing a breach as a balance-sheet risk rather than an operational one.
Watch: Cyber-related extraordinary losses in the November results of GMO, Park24 and Sony Network Communications
- 2
Insurance capacitywithin months
Companies seek higher policy limits and apology payment caps; insurers tighten war exclusions and notification terms and raise prices rather than broaden cover.
Watch: The insured rate in the General Insurance Association of Japan's next SME survey and policy revisions at the major insurers
- 3
Public financeswithin months
If cover does not widen, the risk shifts to the state: the government debates SME support or a publicly backed mechanism in the emergency package, moving the cost into the budget and regulation.
Watch: An SME support or state pool clause in Takaichi's emergency cyber package
What breaks the chain
If insurers quickly broaden apology payment and business interruption cover, or GMO's spread returns to 122 basis points, the chain stops at the first step and the episode remains a single-company reputational problem.
Triggers
Thresholds to watch
| Indicator | Threshold | Today | What it means |
|---|---|---|---|
| Japan 30-year yield | > 4% | 3.90 | If the risk-free yield rises from 3.875% on 28 October to above 4%, corporate spreads widened by cyber losses push refinancing costs higher still. |
Sources
- TokenPost — GMO Yen Bond Spread Widens 52 Basis Points After Cyberattack
- Startup Fortune — Hackers' refused ransom demand is now moving GMO's bond prices
- American Academy of Actuaries — Global Cyber Insurance Toolkit (August 2025)
- Innovatopia — What cyber insurance pays and what it does not (ransom, subcontractor and premium examples)
- Taipei Times — Japanese firms compensating customers after cyberattacks
- Taipei Times (AFP) — China-made AI tool behind cyberattacks in Japan, GMO says
- Nippon.com (Jiji) — Japan Govt Seeks Website Block after GMO Cyberattack
- Yomiuri Shimbun (d menu) — Ministry asks operators to block the attacker's site
- Bernama — Japan to compile emergency cybersecurity package by end of next week
- ITmedia NEWS — Data on about 2.59 million So-net members leaked
Sourcing and verification rules: methodology · Report an error: contact
Related reports
IICyber & Infrastructure·Analysis·Asia-Pacific
Asia's cyber wave hits brokers' rented servers, not the banks
GMO offered a 1 million dollar bounty on 28 October, and the same day 3 more Korean financial firms reported breaches. The headline is the ransom. The constraint is that the rented server layer between client and market falls outside critical infrastructure in both countries.
Cyber & Critical Infrastructure Desk · 28 October 2026 · 6 min
VTech & AI·Analysis·Asia-Pacific
AI chips are concentrating Asia's growth in a single line item
Korea grew 1% on 27 October and chips carried half of it. The same day brought reports that TSMC would raise packaging prices by up to 20%. The headline reads as strength. The constraint is growth tied to one cycle and packaging lead times that have doubled.
Technology Geopolitics Desk · 27 October 2026 · 7 min
IICyber & Infrastructure·Analysis·Asia-Pacific
The PHP patch is out, but Asia's attack window remains open
CYFIRMA said on 24 October that a Korean-speaking group is using PHP2Shell to target governments and banks in 9 countries. The headline is Lazarus, but the constraint lies in unpatchable servers dating back to 2012.
Cyber & Critical Infrastructure Desk · 25 October 2026 · 7 min