Japanese Firms Offer Customer Payments as Cyberattacks Expose Business Risks

News event: 2026-10-26. Updated: October 26, 2026.

Two Japanese companies are responding to cybersecurity incidents with customer compensation, showing how data breaches can quickly become a financial and reputational problem. Reuters reported on October 26 that GMO Internet Group and car-sharing operator Park24 have announced payments to people affected by separate incidents.

What the companies have offered

GMO said customers affected by unauthorized access to its foreign-exchange trading service would receive an initial 5,000 yen payment, with further compensation possible for losses. The company also plans to offer a free alternative service for six months. Reuters reported that GMO received an extortion demand threatening disclosure of company and customer information; the company said it would not pay and was cooperating with authorities.

Park24, which operates car-sharing services, announced 3,000-yen payments to affected customers following a personal-data breach. It expects an extraordinary loss of 5.5 billion yen linked to the incident response and compensation. These figures describe the companies’ announced measures, not a universal standard for breach payouts.

A broader test of cyber resilience

Reuters said Japan had recorded 723 cybersecurity incidents by October 20, exceeding the full-year counts for both 2024 and 2025. The tally underscores pressure on businesses to maintain security while managing customer expectations after an incident.

The costs of a cyberattack can extend beyond repairing servers. Companies may need to investigate unauthorized access, notify users, restore services, assess legal obligations and compensate customers. For financial services, the ability to establish accurate transaction records is especially important when deciding whether users suffered losses.

The incidents also come as defenders confront more automated attacks. Security experts caution that AI can help attackers scale phishing and vulnerability searches, although attributing any particular breach to AI requires evidence. The immediate lesson is operational: security preparedness must include a plan for communicating with customers and recovering trust.