Two major Japanese companies are compensating customers after cyberattacks exposed sensitive information and, in one case, were linked to unauthorized financial trading. GMO Internet is reimbursing confirmed trading losses, while car-sharing operator Park24 expects to spend billions of yen responding to a separate data breach.
The compensation plans come as GMO faces an escalating extortion attempt involving allegedly stolen customer data. The company has refused the attackers' demands and announced additional payments for customers whose information is confirmed in the published material.
GMO offers trading-loss reimbursement and additional payments
The attack targeted Onamae.com Desktop Cloud, a remote desktop service operated by GMO Internet. Some customers use the service to access financial trading platforms.
In an Oct. 24 announcement, GMO confirmed unauthorized access, the theft of customer information, and reports of transactions customers did not recognize.
Its initial compensation package includes:
- ¥5,000 for every current service customer, regardless of whether they suffered financial losses.
- Reimbursement for verified unauthorized trading losses, including realized losses and related fees, where GMO's investigation establishes a connection to the attack.
- Six months of alternative cloud service access for affected customers.
The reimbursement does not cover losses caused by ordinary market movements, missed investment gains, or other indirect damages.
GMO began investigating Oct. 19 after receiving customer inquiries. It detected malicious software the following day and began shutting down service servers Oct. 21 to contain the incident.
Attackers subsequently demanded approximately ¥8 billion, or about $50 million, and threatened to publish stolen information.
On Oct. 27, GMO confirmed that a party believed to be responsible had published information it claimed belonged to the company and its customers. The company was still verifying the contents.
GMO then expanded its compensation plan for customers whose information is confirmed in the publication:
- ¥10,000 for basic information, such as names and contact details.
- ¥15,000 for financial or authentication information, including trading account credentials.
- ¥25,000 for highly sensitive personal information.
The payments are calculated by confirmed information category and are separate from the original ¥5,000 payment and reimbursement of unauthorized trading losses. GMO also announced a $1 million total reward fund for information that helps identify the perpetrators or clarify the incident.
In its Oct. 28 update, GMO said the domain hosting the attackers' published material had been suspended. It warned that mirror sites could appear and urged customers not to access or share the stolen information.
Crucially, GMO said it had not confirmed ransomware deployment as of 1:55 p.m. Japan time on Oct. 27. Data theft, extortion, and unauthorized transactions should not be described as proof that ransomware was executed.
Park24 sets aside ¥5.5 billion after Times Car breach
Park24, which operates the Times Car car-sharing service through subsidiary Times Mobility, has announced a different compensation approach.
The company said attackers exploited a vulnerability in its web system, exposing personal information associated with approximately 6.62 million accounts.
Of those, around 1.46 million accounts had encrypted images of identification documents, including driver's licenses, that showed evidence of access and external transmission.
Park24 is offering eligible customers ¥3,000 in cash or gift cards.
The company expects to record an extraordinary loss of ¥5.5 billion, covering compensation and other incident-response costs, according to its Oct. 23 financial disclosure.
That figure is the total expected incident-related charge, not the amount allocated solely to customer payments.
Park24 also plans to stop retaining identification-document images after verification is complete, reducing the volume of sensitive information held for future attacks.
Unlike GMO, Park24 has not reported unauthorized financial trading associated with its incident. Its compensation primarily addresses the exposure of personal information.
Security expert warns of financial fraud and extortion
The GMO incident raises questions about how far attackers can move after gaining access to a remote service, particularly when customers use that service for sensitive financial activity.
Phillip Wylie, chief security evangelist at Suzu Labs, provided the following assessment:
“What stands out about the GMO Internet incident is that attackers reportedly went beyond stealing customer information and gained access to trading accounts, enabling unauthorized financial transactions. This demonstrates how a vulnerability in a remote access service can have consequences far beyond the compromised system.
"Attackers don’t necessarily need to deploy ransomware to cause significant damage. If they can steal sensitive information, compromise accounts, and threaten to publicly release data, they already have multiple ways to pressure an organization.
"The reported $50 million ransom demand also highlights how extortion tactics continue to evolve. Organizations need to prepare for more than traditional ransomware attacks involving encrypted files. Data theft, financial fraud, and threats of public disclosure can be just as disruptive.
"From an offensive security perspective, this is why testing systems from an attacker’s point of view is so important. Organizations need to understand not only whether a vulnerability exists, but what an attacker could accomplish by exploiting it. Remote access services are particularly attractive targets because they can provide a pathway to sensitive systems and customer environments.
"Organizations should prioritize securing remote access infrastructure, implementing multifactor authentication, monitoring for suspicious account activity, and regularly conducting penetration tests that evaluate potential attack paths.
"The biggest takeaway is that preventing the initial compromise is important, but limiting what attackers can do once they gain access is equally critical.
"One important distinction: GMO’s October 27 update had not confirmed ransomware deployment as of 1:55 p.m. Japan time. The reported data publication and unauthorized transactions are serious developments, but they should not be presented as confirmation that ransomware was executed.”
The distinction between data theft and ransomware is relevant to other recent incidents. In Japan, Burger King disclosed a breach affecting approximately 11.18 million customer records, while Good Smile Company reported unauthorized access to customer and purchase information.
The financial consequences can also extend beyond direct theft. Attackers have used phone-based scams to target financial institutions, combining account compromise and stolen information with extortion attempts.
Japan faces growing pressure to contain cyberattacks
GMO's response has included requests for government assistance under Japan's active cyber defense framework, alongside its own investigation and cooperation with police.
The company has also asked customers to scan their devices, back up data, and follow its official security instructions. Its latest notices warn against phishing messages and fraudulent offers to recover stolen funds.
The two compensation plans reflect different types of exposure: GMO faces customer-data theft and reported unauthorized trading, while Park24 is responding to the disclosure of identity documents and other personal information.
For affected customers, the next questions are whether their information has been confirmed as exposed, what compensation they qualify for, and whether additional misuse emerges.
For the companies, the investigations must still establish the full scope of the damage and whether the security changes introduced after the incidents are enough to prevent another compromise.
Also read: Japan's government network breach put information linked to approximately 246,000 workers at risk after attackers exploited vulnerable network equipment.