Japan Weighs Cyberdefense Powers After GMO Breach

Japan’s government convened its top ministers on Monday evening after data breaches affecting millions of people began causing financial losses. The meeting puts state power at the center of a crisis in which customers’ accounts were accessed without authorization and the government is weighing measures that can reach into an attacker’s server.

Some users of GMO Internet Group’s foreign-exchange margin-trading service reportedly lost more than 1 million yen through transactions using unauthorized access to their accounts. GMO said the previous week that the breach potentially affected 26,739 of its servers and involved customers’ trading accounts at more than 70 securities firms, foreign-exchange providers and other businesses in Japan and overseas.

Customers Pay for a Breach

GMO CEO Masatoshi Kumagai apologized for the company’s failure to protect customers in a blog post on his personal website Sunday. He pledged to compensate victims for their losses, as well as make a uniform ¥5,000 ($32) payout to all users. The company’s promise comes after the breach put customers’ financial assets at risk.

Kumagai urged the government to help deploy active cyberdefense measures. “Now is the time to protect Japan — and the internet — through public–private cooperation,” he wrote. He also said that, in his assessment, “the internet itself is now on the verge of breaking down.”

The government’s ministerial meeting brought together Prime Minister Sanae Takaichi, Chief Cabinet Secretary Minoru Kihara, digital minister Toshiharu Furukawa and the ministers for finance and defense, among others. The state’s response now sits with officials and agencies, while customers bear the reported losses and GMO faces criticism for failing to protect them.

Who Gets to Reach Into the Network

Kihara said police, the Defense Ministry and the Self-Defense Forces would decide whether to use access-neutralization measures. Those measures involve breaking into an attacker’s server to neutralize it. “This determination will be made regardless of whether the affected organization has requested such measures,” he said, describing a power that does not depend on a company asking for it.

At a news conference earlier Monday, Kihara declined to say how the government would respond to GMO’s request, saying comments on individual attacks could reveal its strategy. He said the government receives information from affected organizations, provides necessary support and takes measures according to each case.

GMO’s request has also exposed the law’s stated limits. Kumagai acknowledged criticism because government intervention is typically limited to operators of critical infrastructure such as utilities and transportation companies. He said he understood that the government decides when and how to intervene. No decision on GMO’s request was announced in the article.

A New Law, and a Wider Mandate

Parliament passed the Active Cyber Defense Act in May 2025. The law took effect on October 1, 2026, and authorizes access-neutralization measures intended to prevent cyberattacks at their source and neutralize threats before they become attacks. Kumagai urged action under the act, calling it an opportunity to make the system “genuinely protect citizens’ assets.”

GMO Cybersecurity by Ierae, a GMO Internet Group subsidiary, said it traced the attack to an artificial intelligence tool called Artex. An investigation by U.S. cybersecurity firm CrowdStrike into Artex attacks in South Korea suggested the threats most likely originated in China. No direct connection between China and the attacks on GMO had been established at the time of the report. The meeting, the law and the proposed intervention all place decisions in institutional hands; the people whose accounts were accessed remain the ones facing the reported financial damage.