GMO Internet Pays Every Customer After Desktop Cloud Breach: A Breach Response Case Study

A Japanese internet company is paying every customer of a hacked service, whether or not they lost money. GMO Internet, Inc., part of GMO Internet Group, said on October 24, 2026 that it will make a flat Â¥5,000 payment to all current users of “Onamae.com Desktop Cloud,” a virtual desktop service that many customers used to run automated foreign exchange trading. It will also compensate customers for realized losses from trades they did not make. The company confirmed that the service had security vulnerabilities, that attackers accessed it without authorization, and that customer information was taken.

The case is a useful study in breach response for two reasons. GMO separated a goodwill payment from loss compensation and wrote clear rules for each. And the attack has pushed Japan’s government to talk about using AI to simulate attacks on industry systems.

What happened

• The service. Onamae.com Desktop Cloud provides remote Windows desktop environments. Customers used it to keep trading platforms such as MT4 and MT5 running around the clock.
• The breach. In its fourth report on the incident, GMO said its investigation confirmed vulnerabilities in the service’s systems, unauthorized access to its environment, and that customer information was taken outside the company. Some customers reported transactions in their trading accounts they did not recognize.
• The scale. Euronews reported that GMO’s founder and CEO, Masatoshi Kumagai, said the incident potentially affected 26,739 servers and involved unauthorized operations on accounts at more than 70 securities and foreign exchange firms in Japan and abroad.
• The government request. Nikkei reported that GMO asked the Japanese government to apply its new “active cyber defense” powers to the case, an unusual request for state help.

How GMO structured its response

GMO’s notice sets out three separate measures. Each has its own scope, which makes the response easier to follow than many breach announcements.

1. A flat goodwill payment. Every customer currently using the service gets Â¥5,000, regardless of whether they suffered a loss, “in recognition of the inconvenience and anxiety caused.” GMO said it would email eligible customers by 23:59 on October 30, 2026 with how they will be contacted and paid.
2. A replacement service. GMO will not restart the service on the infrastructure that was breached. Customers who want to keep a Windows desktop will be offered migration to a replacement on separate cloud infrastructure, free for six months, and will not be moved without their consent.
3. Loss compensation. GMO will cover realized losses, such as trading losses and fees, from transactions its investigation confirms were unauthorized and caused by the breach. It will not cover market movements, lost profits or other indirect damages. Customers must submit evidence, which can include identity documents and a view-only password for their trading platform, and should ask their broker about cancelling the trades. If a broker refunds part of the loss, GMO pays the rest. If a broker refuses, GMO still pays eligible losses. GMO said it would announce the application process by November 6.

There is a privacy tension in that third step. To prove a loss, customers are asked to hand over more personal and financial data, including trading platform access, to the company that just lost their data. GMO limits this to view-only access, which is the right instinct. Any company copying this model should collect only what is needed to verify a claim, protect it separately, and delete it once the claim is settled.

The government’s AI response

The GMO breach came during a hard week for internet security in Japan. On October 23, Japan said it would set up a team to simulate cyberattacks using AI to find weaknesses in technology systems, as organizations around the world rushed to deal with critical flaws in the PHP programming language, according to Reuters reporting carried by Investing.com. Public reporting has not tied the GMO breach to the PHP flaws, and GMO has not described the vulnerability.

Japan has had other large incidents involving third-party software, such as the email platform breach covered in our report on the KDDI data breach affecting 12 million people.

Legal duties under Japan’s privacy law

Japan’s Act on the Protection of Personal Information (APPI) requires businesses to report certain leaks to the Personal Information Protection Commission and to notify affected individuals. Reportable cases include leaks that may cause financial loss through unauthorized use, leaks caused by wrongful intent such as hacking, and leaks involving more than 1,000 people. The APPI rules call for a preliminary report promptly, generally within three to five days, and a final report within 30 days, or 60 days where wrongful intent is involved. A breach like GMO’s likely meets more than one trigger. Our guides to APPI compliance and the APPI amendments explain the duties, and companies sending data to Japan should also review APPI cross-border transfer rules.

Lessons for any company planning its breach response

• Decide in advance how you will treat customers who suffered no loss. A small goodwill payment can rebuild trust, but it should be separate from compensation so it is not read as a cap on liability.
• Write compensation rules people can follow. State what is covered, what is not, what evidence is needed, and the deadlines.
• Do not restart on compromised infrastructure. GMO’s decision to rebuild rather than patch and reopen is a clear signal to customers.
• Treat claims data as new personal data. Limit it, secure it and set a retention period.
• Keep updates numbered and dated. GMO’s notice was its fourth report. A clear sequence helps customers, regulators and the press.

Our article on what actually happens in a privacy incident response covers the first days, and our piece on the convergence of privacy, security and incident response explains why the teams need one plan.

Where Captain Compliance fits

Captain Compliance’s data mapping and records tools help teams know in advance which systems hold which customers’ data, which shortens the time needed to scope a breach and decide on notifications. Its data subject request portal can handle the access requests that often follow a breach. These tools support a response plan. They do not prevent breaches or decide notification duties for you.

Frequently asked questions

Who gets the ¥5,000 payment?

Every customer currently using Onamae.com Desktop Cloud, regardless of whether they suffered a financial loss, according to GMO’s October 24 notice.

Does GMO cover all trading losses?

No. It covers realized losses, such as trading losses and fees, from transactions it confirms were unauthorized and caused by the breach. Market movements, lost profits and indirect damages are excluded.

Was the breach caused by the PHP vulnerabilities?

That has not been reported. GMO has said its systems had security vulnerabilities but has not identified them publicly.

Must Japanese companies notify regulators of breaches?

Yes, for certain leaks under the APPI, including those caused by hacking, those that may cause financial loss, and those affecting more than 1,000 people.

What is Japan’s new AI cyberattack simulation team?

The government said on October 23, 2026 that it would set up a team to simulate cyberattacks with AI to find weaknesses in industries’ IT systems. Details have not been published in the sources we reviewed.

Paying for anxiety

Â¥5,000 is about the price of a nice lunch in Tokyo. The amount matters less than the principle. GMO decided that customers who lost nothing still deserved something for the worry, and said so in writing. Few companies outside Japan do that. Whether regulators and courts elsewhere start to treat anxiety as a harm worth paying for is one of the open questions in breach law. GMO has answered it for its own customers before anyone made it.