GMO Internet will pay every customer 5,000 yen after unauthorised access to its currency-trading service, and Park24 will pay 3,000 yen to 1.46 million car-sharing users whose identity documents were transmitted. The cheques arrive as Japan answers critical PHP flaws with AI-simulated attacks, suspended disaster alerts and a debate over what a breach is worth.
Published 26 October 2026 · 03:10 GMT
GMO Internet will pay every customer 5,000 yen after unauthorised access to its currency-trading service, and Park24 will pay 3,000 yen to 1.46 million car-sharing users whose identity documents were transmitted. The cheques arrive as Japan answers critical PHP flaws with AI-simulated attacks, suspended disaster alerts and a debate over what a breach is worth. GMO Internet will compensate customers after unauthorised access to its foreign-exchange trading service, paying every customer 5,000 yen (about $32) as an “initial gesture of good faith”, chief executive Masatoshi Kumagai said in a blog post on Sunday.
Two Japanese companies are paying customers after cyber incidents, GMO Internet 5,000 yen per customer and Park24 3,000 yen per affected user, against the backdrop of critical PHP flaws that knocked websites offline worldwide.
Whether the flat payments are fair redress or token gestures; Park24’s critics call 3,000 yen too low, while the companies frame the sums as good-faith first steps.
Who attacked GMO, the total losses, whether the encrypted identity images transmitted from Park24 can ever be decrypted, or whether the payments cap the companies’ liability.
On Monday 26 October 2026, GMO Internet said it would compensate customers after unauthorised access to its foreign-exchange trading service. Every customer receives 5,000 yen, about $32, as an “initial gesture of good faith”, chief executive Masatoshi Kumagai wrote on Sunday. Days earlier, Park24 had set its own price: 3,000 yen, about $19, to each of roughly 1.46 million Times car-sharing users whose identity images left the company.
The payments land amid a national emergency patch, after two critical PHP flaws prompted millions of hacking attempts last week. Government and company websites went offline in Japan, Europe and beyond, Tokyo announced an AI attack-simulation team on Friday, and SoftBank suspended its earthquake and tsunami alerts. Markets noticed: GMO shares fell 11 per cent in Tokyo on Monday, against a flat benchmark, after a $2.6 billion Friday close.
GMO’s promise has two layers: compensation for losses, plus 5,000 yen to every customer, not only those who prove a loss. The word “initial” matters, since further payments may follow once losses are assessed, and no total has been given. Park24’s terms are tighter: about 6.6 million Times Car accounts were affected, yet the 3,000 yen goes only to the roughly 1.46 million whose identity images, including driving licences, were both accessed and transmitted externally. The payments should cost about 4.4 billion yen, with an extraordinary loss of 5.5 billion yen booked for the year ending in October.
Park24 added a caveat: the images were encrypted, so access does not mean the contents became immediately viewable, yet future decryption “cannot be completely ruled out”. That sentence brought in the lawyers: Yuki Makino of Makino Law Office called 3,000 yen “too low”, with over 90,000 people registered for a planned lawsuit. GMO, meanwhile, disclosed a money demand from a party believed to be behind the attack, with a disclosure threat; it refuses to comply, will coordinate with police, and has asked the government for cyber defence measures.
At GMO, attribution and scale are unknown: who attacked, how they got in, and how many customers lost money trading. At Park24, the open question is cryptographic, since nobody can promise that transmitted encrypted images will never be decrypted. Beyond both firms, the PHP gaps remain: how many hacking attempts succeeded, who was compromised rather than merely probed, and whether the shutdowns caught every vulnerable system in time.
Compensation turns a breach into a unit-priced liability. Until now, the standard response was disclosure, apology and remediation, with costs borne quietly in technology budgets. Multiply 3,000 yen by 1.46 million people, however, and the bill is 4.4 billion yen before lawyers, regulators and lost customers. The timing amplifies the signal: the payments come as Japan’s government treats the PHP flaws as a national-grade event, with an AI red-team, an “extremely urgent request” from Prime Minister Sanae Takaichi, and disaster alerts suspended for over 30 million SoftBank customers. There is also a precedent effect, since the next firm’s customers will ask why they got nothing, or less, while India’s CERT-In rated the flaws critical on 21 October and the Philippines’ response team ordered immediate patching.
Geopolitically, Japan’s AI simulation team marks a doctrinal shift: from patching after disclosure to attacking its own systems first. Industry minister Ryosei Akazawa put it plainly, an attack needs only one hole, while GMO’s request for government help tests the corporate-national boundary. Economically, the week repriced cyber risk in public: GMO down 11 per cent, Park24 booking a 5.5 billion yen loss. Demographically, the exposed are ordinary consumers: car-sharing users, currency traders, mobile users without disaster alerts. Historically, the week compressed earlier internet-wide patch panics into days; firms must now respond within hours rather than weeks, one Australian security executive said. Technologically, the root cause is concentration: PHP runs about 70 per cent of identifiable sites, so two flaws rated 9.2, allowing unauthenticated remote code execution, became a global event overnight, a feedback loop the Bank of Japan's warnings about AI-driven market risks already tracks.
Insurers pay first, then charge for it, as cyber policies are rewritten around per-user compensation, with higher premiums and sharper exclusions for unpatched known flaws. Small firms and public services pay next, and they can least afford it: the shutdowns swept up municipalities, a childcare app, a university and a tax agency alongside banks, airlines and railways. Users, organised, collect third, since the Makino model will be copied wherever a flat payment looks small beside the risk, and courts will then price a leaked driving licence. Attackers, finally, keep the extortion economy alive: GMO refused a demand backed by a disclosure threat, yet refusal works only if disclosure is survivable.
Watch GMO’s loss assessment first: whether the “initial” 5,000 yen grows once trading losses are tallied, and what the government answers on cyber defence. Watch the Park24 lawsuit next, and the results for the year ending in October, since a judgment above 3,000 yen per person would reprice every similar breach. Watch patch compliance, and the red-team, above all: Japan’s AI unit has yet to publish its staffing, timetable or first findings, and the world’s PHP estate still includes versions that will never receive an official fix, so the next AI-discovered flaw will test whether operators patch in hours, or merely apologise in thousands of yen, a lesson reaching beyond Tokyo, as an earlier cyberattack that emptied French supermarket freezers already showed.
Compensation is the new disclosure From Washington, London and Brussels, the story reads as liability pricing: the US National Security Agency urged PHP operators on 21 October to patch immediately or go offline. European advisories issued the same warning, the White House said federal agencies were working with leading AI labs to speed a fix, and a flat payment to every customer is therefore not generosity, but the market’s first number for a breach.
Tokyo is turning defence into doctrine From Tokyo, the story reads as a state stepping onto the front line: Prime Minister Sanae Takaichi called the shutdowns an extremely urgent request. The National Cyber Office endorsed taking sites offline where patching could not be done quickly, an AI red-team will probe the country’s own systems, and Nomura, MUFG, ANA, JR East and ministries from finance to meteorology all suspended services.
The patch race reaches the Global South’s servers From Delhi and Manila, the story reads as exposure without equal capacity: India’s CERT-In issued a critical note on 21 October, warning of remote code execution and full system compromise. The Philippines’ response team ordered agencies, infrastructure operators and hosts to patch at once, citing public proof-of-concept research and attack attempts, yet confirming no Philippine compromise, while small sites on shared hosting depend on hosts, not owners, to patch.
GMO Internet said it would compensate customers for losses from unauthorised access to its foreign-exchange trading service, and that every customer would receive 5,000 yen, about $32, as an initial gesture of good faith. The payment was announced by chief executive Masatoshi Kumagai in a blog post on Sunday 25 October, and the word initial leaves room for further payments.
The payment goes to about 1.46 million Times Car users whose identity-document images, including driving licences, were both accessed and transmitted externally after a September breach. It is paid in cash or gift certificates. About 6.6 million accounts were affected overall, but only the users whose document images left the company qualify for the payment.
Two critical vulnerabilities in PHP, collectively called php2shell and rated 9.2 in severity, could let an unauthenticated attacker run code remotely on a web server. PHP powers about 70 per cent of websites whose server language can be identified. Fixed releases were published on 21 October, and versions 8.1 and older receive no official fix.
SoftBank, Japan’s third-largest mobile carrier with more than 30 million smartphone customers, suspended its emergency alert system on Friday while it addressed a PHP vulnerability. Customers therefore missed early warnings for earthquakes, tsunami alerts and disaster information through that channel, though warnings remained available through services such as its Yahoo app.
Not necessarily. Park24 says it will respond case by case if actual damage occurs, and a law office organising affected users calls 3,000 yen too low, with more than 90,000 people registered for a planned lawsuit. GMO’s payment is explicitly described as initial, so further compensation may follow once customer losses are assessed.
