Japanese Companies Are Now Paying Customers After Cyberattacks: Your Questions on GMO, Park24 and the Bill That Follows a Breach

When a company is hacked, the costs most people think of are the ransom demand and the cleanup. A run of attacks in Japan is putting another cost in the spotlight: paying customers back. Two well-known companies have just announced payments to their users, and one of them is also covering losses caused by the break-in.

This Q&A draws on Reuters’ report, as published by CNA.

What happened at GMO?

GMO Internet Group, a large Japanese provider of internet infrastructure and online financial services, says someone gained unauthorized access to its foreign exchange trading service. In a blog post on Sunday, chief executive Masatoshi Kumagai said customers would be compensated for losses that resulted, and that every customer would also receive 5,000 yen, about US$32, as a goodwill payment. GMO will also offer customers a free alternative service for six months.

Did the attackers ask for money?

Yes. GMO says it received a demand for money from a party it believes is behind the attack, along with a threat to publish company and customer information. The company says it will not pay and is working with police and other authorities.

Is this connected to the PHP flaws in the news?

Not according to GMO. Reuters notes that government and business websites in Japan, Europe and elsewhere went offline last week as attackers went after newly disclosed PHP flaws, but GMO did not mention any connection to them.

What did GMO admit about its own defenses?

Kumagai wrote that white-hat hackers working for the company had found security problems, but that the depth and speed of the response to those findings were not enough. That is an unusually candid admission, and a familiar pattern: the issue was known, but fixing it took too long.

Who else is paying?

Park24, which runs the Times car-sharing service, said on Friday it will pay customers 3,000 yen each after a personal data breach last month. It expects an extraordinary loss of 5.5 billion yen from responding to the attack and from compensation. It also said it will stop keeping images of identity documents once registration checks are complete.

How did investors react?

When trading resumed after the announcement, GMO shares fell by double digits to a four-month low, while Tokyo’s benchmark index edged up. GMO says it cannot yet estimate how much the payments and compensation will affect its earnings.

Are attacks in Japan really increasing?

Data from TrendAI counts 723 cybersecurity incidents in Japan in the year to October 20, already more than the full-year totals for 2025 and 2024. ESET Japan’s president cautioned that the rise may partly reflect better detection and more disclosure, not only more attacks. Separately, the government said on Friday it will set up a team that uses AI to simulate attacks and find weaknesses, and Kumagai has urged the government to apply the new cyberdefence system it introduced this month in response to the attack on GMO.

What does this mean for costs?

An analyst at IwaiCosmo Securities told Reuters that because companies already have standard security measures, strengthening them further could bring a substantial extra cost. The compensation announcements show the other side of that ledger: weak defenses can also become very expensive after the fact.

What this means for your company

Few small businesses will ever pay customers 5,000 yen each, but the lesson scales down. A breach can bring costs that never appear in a ransom note: refunds, credits, free services, legal notices and lost trust. Two habits from this story are worth copying now. First, fix known security findings quickly, because a finding that sits in a queue is an open door. Second, follow Park24’s lead and stop keeping sensitive data you no longer need, such as copies of IDs after you have verified a customer. Data you do not hold cannot be stolen, and it does not have to be compensated for.

Need help estimating what a breach would really cost your business and cutting the data you keep to what you need? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.