GMO Internet Group has asked the Japanese government to deploy its new active cyber defence powers after hackers breached its Onamae.com Desktop Cloud service. The incident, which affected up to 26,739 servers, exposed trading logins and led to unauthorised trades. GMO reported that attackers planted malicious software, demanded payment, and threatened to place further unauthorised trades, leak data, and launch a ransomware attack. The company has refused to pay the ransom and is working with police, warning that any data published by the attackers may be partly false.
This is the first request for state intervention under Japan’s new cyber defence law, which allows police and the Self-Defense Forces to disable attackers’ servers. However, GMO is not classified as a critical infrastructure operator under the law, raising questions about the scope of government action. GMO has also asked exchanges and brokers to block access from the compromised service and is offering compensation to affected customers.
For regulated firms, this case shows the rising risk of cyber extortion and the need for robust response plans. The incident may prompt review of which sectors are covered by new cyber defence laws and how quickly authorities can act. The financial impact for GMO remains unclear, with the service permanently closed and loss claims process pending.
