Japanese Prime Minister Sanae Takaichi ordered her cabinet Monday to assemble emergency cybersecurity measures by the end of next week and to seek help from allies in identifying who is behind a string of attacks on Japanese companies, Bloomberg reported. The move follows an extortion attempt against GMO Internet Group and signals that Tokyo now treats corporate breaches as a national security matter.
What Happened
At an emergency ministerial meeting in Tokyo, Takaichi said the government would choose and carry out a full range of countermeasures, including steps to neutralize the threat, according to Bloomberg, which reported she gave no further detail. "This has become a serious situation," she said, according to AFP.
She asked Toshiharu Furukawa, the cybersecurity minister, to work with allies, like-minded countries and international organizations to identify the attackers and build a joint response, Bloomberg reported. Neither the government nor the companies involved has publicly named the attackers. Dozens of Japanese businesses have reported unauthorized access to their systems and possible leaks of client data in recent weeks, according to AFP.
The most prominent case is GMO Internet Group, an IT services company. It reported unauthorized access to its foreign-exchange trading service, and some customers saw transactions they did not recognize. On Saturday it asked the government to help neutralize the source of the activity, Bloomberg reported.
Founder and Chief Executive Masatoshi Kumagai said in blog posts that a party believed to be behind the attack demanded $50 million in cryptocurrency and threatened to release company and customer information, Reuters reported. AFP reported that the hacker had set a deadline of last Wednesday. GMO said it will not pay and is working with police. It will compensate customers for losses from the unauthorized access and give every customer 5,000 yen, about $32, as a goodwill payment.
GMO shares fell almost 16% Monday to a four-month low, according to Reuters. The company was worth $2.6 billion at Friday's close.
Why It Matters
For boards, the GMO case shows the full cost of a modern extortion attack: direct customer losses, compensation paid to an entire customer base, and a sharp loss of market value, even when the company refuses to pay. Shoichi Arisawa, an analyst at IwaiCosmo Securities, told Reuters that strengthening defenses could prove expensive for Japanese companies.
The government response matters as much as the attack. A new set of laws that took effect less than a month before the GMO incident allows "active cyber defense," meaning authorities can move to find and disrupt threats before they strike, and it pushes companies and government agencies to coordinate, Bloomberg reported. Reuters reported that such steps could include attacking hostile servers, and that Kumagai urged the government to apply the new measures. A private company publicly asking the state to act against attackers is an early test of how those powers will be used.
Takaichi's call for a joint international effort to identify attackers also means that what Japan learns could be shared with partner governments.
Context
GMO is not the only company paying customers after a breach. Park24, which runs the Times car-sharing service, will pay customers 3,000 yen after a personal data breach last month and expects an extraordinary loss of 5.5 billion yen, Reuters reported. The Primary Wire reported in September that Times Car confirmed data theft from 6.6 million accounts, citing BleepingComputer.
Security company TrendAI counted 723 cyber incidents in Japan in the year to Oct. 20, more than in all of 2025 or 2024, according to its own data cited by Reuters. Reuters also noted a separate wave of hacking attempts after critical flaws in the PHP programming language were disclosed, which The Primary Wire reported last week; GMO did not connect its incident to those flaws.
Economy Minister Ryosei Akazawa said Japan plans to launch a team of white-hat hackers, security specialists who look for weaknesses so they can be fixed, Bloomberg reported. Reuters reported the government said Friday it would set up a team that uses artificial intelligence to simulate cyberattacks and find weak points.
What to Watch
- The contents of the emergency package, due by the end of next week, and whether it adds obligations for private companies.
- Whether Japan uses its new active cyber defense powers against the infrastructure behind these attacks.
- Any joint attribution with allies naming the attackers.
