GMO Internet to pay 5,000 yen to all Desktop Cloud users after breach

GMO Internet said on October 24 that it will compensate losses from unauthorised transactions on its "Onamae.com Desktop Cloud" service, which was hit by a cyberattack, and will pay 5,000 yen to every current user of the service as a gesture of apology, according to japan.cnet.com.

The company said it confirmed that user information was taken outside the company through unauthorised third-party access caused by a security problem in the system. Some users reported unauthorised trades in their FX and other trading accounts.

Compensation covers confirmed losses from unauthorised trades that GMO Internet recognises were caused by the breach, including trading losses and fees. Market fluctuation losses and expected profits are not covered. Users must submit trading records and consult their brokerages or FX companies about cancellations and refunds; GMO Internet said it will pay recognised losses even if the broker does not refund. Application methods and payment timing will be announced by November 6.

The 5,000 yen payment covers all current users, including those with no confirmed damage, and details will be sent to registered email addresses by 11:59 p.m. on October 30. The affected system infrastructure will not be restarted; users will be guided to migrate to an alternative service on a different cloud platform, free for six months after migration. Migration requires user consent, and the start date, treatment of contracts and fees for non-migration, and pricing after the free period will be announced by October 30.

Company refuses demand and seeks state action

GMO Internet said it has received a demand for money from suspected attackers, who threatened to continue unauthorised manipulation of user trading accounts and to publish information or carry out ransomware attacks if not paid. The company refused the demand, submitted evidence to police, and asked securities and FX companies to block or force-disconnect access via the affected service.

GMO Internet also urgently asked government agencies to apply "active cyber defense," a framework in which the state identifies and disables attackers' systems. The company argued that private companies alone cannot handle attacks directly targeting users' financial assets, and positioned this case as the first invocation of active cyber defense.