GMO Internet asks Japan to invoke active cyber defense after cloud breach

On October 24, GMO Internet Group announced its urgent request for Japan's government to apply the country's active cyber defense law after unauthorized access to up to 26,739 servers in its Onamae.com Desktop Cloud service, a Windows remote-desktop VPS product used by retail foreign-exchange traders. The company first disclosed the intrusion on October 21 and said malicious programs were placed on customer server environments. GMO shut down all servers on Wednesday and said user login information may have been stolen.

CEO Masatoshi Kumagai wrote in an October 25 blog post that the attackers used their access to place unauthorized trades for customers at over 70 brokerages globally, rather than stealing data alone. He said the internet "is already starting to break down" and formally asked the government to invoke the active cyber defense law. The possible attacker demanded money and threatened to release company information if the demand was rejected; GMO said it intends to refuse and has asked police to investigate. Kumagai added that the attackers also threatened to leak personal data from compromised customers' PCs, deploy ransomware, and expose internal information about GMO's systems and operations.

GMO promised every affected customer a flat ¥5,000 consolation payment and said it will fully compensate trading losses tied to the unauthorized access, even if an exchange or broker refuses to cover the loss. It will also provide a free replacement hosting environment for six months and plans to redesign the underlying system architecture with external security experts. The Japan Times reported that GMO said Saturday it will compensate users for reported losses and make the ¥5,000 payment to all users regardless of financial damage.

Japan's Active Cyber Defense Law came into force on October 1. It allows police and Self-Defense Forces to access attackers' servers and remove malware or disable attack-command functions when an attack on critical infrastructure is confirmed; the National Cyber Security Office coordinates the response, and in principle a third-party oversight committee must give prior approval. GMO's request could become the first application of the system. Government officials said a company request alone does not trigger action. An NCO executive said there is "no mechanism for accepting requests from individual companies," but the government will consider severity and urgency based on information or consultations. The government also said it will not disclose whether neutralizing measures have been implemented. GMO said private-sector defenses alone cannot eliminate sophisticated cybercriminal groups that steal people's assets.

Experts voiced doubts about using the system for GMO's situation. Keio University professor Taiyo Tsuchiya said the request "differs from the neutralizing measures envisioned under the active cyber defense system," and Jun Osawa of the Sasakawa Peace Foundation said the hurdle is extremely high because another country might view it as an act of war.

Kumagai blamed AI-powered attack tools for the scale of the incident. He said GMO Cybersecurity by Ierae's research found that ARTEX, an autonomous penetration-testing tool developed by GMO for defense, had been misused by attackers against about 20 Japanese companies. He called the current wave an "AI cyber-saturation attack" and pointed to the recent PHP vulnerability, where automated exploit attempts jumped from thousands to millions in the first hours after the flaw became public. Kumagai also argued the breach is a national concern, not "one company's trouble," because the service connected to financial infrastructure at more than 70 companies and held customer savings and personal data hostage.