Japanese companies compensate users as cyberattacks buffet economy

Japanese companies are moving to pay compensation to users following waves of cyberattacks that have disrupted internet services and raised concerns about economic stability.

GMO Internet Group said customers would be compensated for losses stemming from unauthorised access following a cyberattack on its foreign exchange trading service, and all customers would receive 5,000 yen ($32) as “an initial gesture of good faith,” CEO Masatoshi Kumagai said in a blog post on Sunday.

Japan said ⁠on ​Friday it would set up a team to simulate cyberattacks using AI to identify weaknesses in technology systems as organisations scrambled to curtail risks from flaws in the PHP programming language that underpins much of the internet.

Shares of GMO, which had a market value of $2.6 billion as of Friday’s close, slumped nearly 14% to a four-month low against a 0.3% rise in Tokyo’s benchmark index.

Japanese ​companies ​are being roiled by attacks with experts saying AI is helping automate ⁠tasks from scanning for software vulnerabilities to crafting phishing campaigns, making cybercrime faster, cheaper and harder to detect.

Government and company websites in Japan, Europe and elsewhere went offline last week after the ‌disclosure of critical vulnerabilities in the PHP programming language prompted millions of hacking attempts.

GMO has made a request to the Japanese government to apply cyberdefence measures in response to the cyberattack, after the introduction of a cyberdefence system this month.

Story continues below this ad

The system could involve steps such as attacking hostile servers to neutralise threats.

“Now is the time for the public and private sectors to work together to protect Japan,” wrote Kumagai, whose sprawling internet group encompasses internet infrastructure, financial services and cryptocurrency trading.

GMO said it received a demand for money from a party believed to be behind the ⁠attack, along with a threat ⁠to disclose company and customer information if it did not comply.

GMO said it would not comply with the demand and would respond to the incident in coordination ⁠with police and other authorities.

Story continues below this ad

The company, ‌which will provide a free alternative service to its customers for six months, said it could ​not currently calculate the impact on earnings from the goodwill payments and compensation ‌for losses.

Customer data protection weaknesses

The scale of recent cyberattacks has exposed weaknesses in Japanese companies’ ability to protect their wealth of customer data.

There have been 723 cybersecurity incidents in the year to October 20, according ‌to data from TrendAI, exceeding ​the annual totals in ​2025 and ​2024.

“Reports may reflect both the threats organizations face and greater visibility into incidents that would previously have gone undetected, been underinvestigated, or remained undisclosed,” said Satoshi Nagano, president of cybersecurity firm ESET ​Japan.

Story continues below this ad

Park24, which operates the Times car-sharing service, said on Friday it would make ⁠3,000-yen payments to customers following a personal data breach.

The company said it would no longer retain identity document images after completing registration verification and expects to book an extraordinary loss of 5.5 billion yen due to responses to the attack and compensation ‌payments.

Well-resourced companies will ⁠be able to offset rising cybersecurity risk by investing in stronger defences, according to a report from Moody’s Ratings.

“Those with weak patching practices are likely to fall further behind, especially if ​they have large digital networks that greatly broaden their attack surface,” according to the report.