Can Japan's New Active Cyber Defense Law Help GMO's Hacked FX Trading Customers?

TL;DR

---

On October 24, 2026, GMO Internet announced that it had made an urgent request to the Japanese government to apply “active cyber defense” after its cloud servers for automated FX (foreign exchange margin) trading were breached.
Active cyber defense is Japan’s new framework that lets the police and the Self-Defense Forces (SDF) access servers used in attacks and neutralize them. The relevant part of the law took effect on October 1, just over three weeks earlier.
GMO describes the incident as the “first activation” case for active cyber defense.

It looks like a private company asking the state to use a national-defense tool, yet nobody has said a foreign government was behind the attack.
GMO’s announcement does not cite a specific provision. Still, the clause that the active cyber defense legislation added to the Police Duties Execution Act shows how such a request can work even when the attacker is not a state.

The breach of an FX trading VPS service

Onamae.com Desktop Cloud rents out Windows virtual private servers (VPS) for running FX auto-trading tools 24 hours a day.
Customers run trading tools such as MetaTrader 4 (MT4) and MetaTrader 5 (MT5) on these servers to place orders automatically in their accounts at brokers and FX firms (ASCII.jp, Japanese).
The trading tools store the login credentials (the ID and password) for those accounts, so the servers hold them for every customer’s brokerage account.

The timeline below comes from GMO’s fourth and fifth notices (4th notice, 5th notice, Japanese).

Date (JST)	Event
Oct 19	Investigation starts after a customer inquiry
Oct 20	Malicious programs planted by a third party found on some servers. New sign-ups and the control panel suspended
Oct 21, 04:00	All server plans shut down in sequence. First notice published
Oct 21 onward	Customers report operations they did not make in their trading accounts
Oct 22	GMO consults the police. Second notice at 16:59
Oct 23, 16:10	Third notice
Oct 24, 11:50	Fourth notice announces compensation and the request to the government. Fifth notice the same day

The first notice said “we have not confirmed that the viewed information has been misused.” The second notice on October 22 changed this. It said login credentials for trading accounts may have been obtained by a third party and used without authorization (J-CAST News, Japanese).
The number of potentially affected servers is 26,739. GMO says this is the number of servers that could be affected, not the number of confirmed compromises (5th notice).

Customers had unauthorized orders placed in their trading accounts with the stolen credentials, and their balances were drained.
The accounts sit at the brokers and FX firms, not at GMO. Shutting down GMO’s servers does not stop an attacker who already holds the credentials from placing orders from somewhere else.
One customer interviewed by TBS noticed on October 21 that the account balance had gone to zero.
The trading history showed losses totaling more than 4 million yen within two seconds. About two hours later, a sender calling itself “HackingTeam” emailed the customer, saying in effect that the balance had been wiped because GMO refused to negotiate (TBS NEWS DIG, Japanese).
The claim-of-responsibility site linked in the email reportedly said the group had “destroyed accounts worth about 7.7 billion yen in 24 hours.” That is the attacker’s claim, and the actual damage has not been confirmed.

In the fourth notice, GMO disclosed that people believed to be the attackers had demanded money and threatened to publish information if GMO did not pay.
The first threat was to keep placing unauthorized orders in customers’ accounts at more than 70 brokers and FX firms in Japan and abroad.
The second was to publish information about the service and about customer PCs that had connected to it, and to carry out a ransomware attack.
The third was to publish information about GMO’s systems and operations.

GMO said it would not pay, and that it had handed communication records and other evidence to the police cybercrime unit and asked for a criminal investigation.
It also announced a flat 5,000-yen payment to every current user of the service, compensation for realized losses from unauthorized trades, and six months of free use of a replacement service running on a separate cloud platform.

What GMO asked for: tracking and neutralizing the attackers’ infrastructure

The second half of the fourth notice has a section titled (translated) “On our submission to the government regarding the application of ‘active cyber defense’ to protect citizens’ assets,” and that is where the request is laid out.
GMO calls the attack an unprecedented method that went beyond encrypting or stealing data and directly targeted ordinary people’s trading accounts, and writes (translated):

Defense and after-the-fact response by a private company alone cannot eradicate the plundering of citizens’ assets by sophisticated cybercrime groups operating across borders.

GMO then calls the incident “the ‘first activation’ case of active cyber defense to protect citizens’ property and trust in cyberspace” and asks government agencies for “state-led tracking, blocking, and neutralization of the attack infrastructure” (both translated).
Attack infrastructure here means equipment the attackers run for the attack, such as servers that send commands to the malicious programs and sites where stolen data is posted to back up the extortion.
GMO has already shut down its own servers, so what it wants dealt with is the attackers’ equipment outside the company.

GMO has asked the police to investigate and catch the perpetrators. This separate request asks the state to stop the attack by directly accessing and neutralizing the attackers’ equipment.

What active cyber defense lets the state do

Active cyber defense was introduced by the Act on Strengthening Cyber Response Capabilities, enacted on May 16, 2025, together with a companion act that amends related laws.
Material from the National Cybersecurity Office (NCO) in the Cabinet Secretariat describes the framework like this (NCO implementation briefing, Japanese).

Part	What it does	In force
Public-private cooperation	Requires critical infrastructure operators in sectors such as electricity, telecom, and finance to register the equipment they use and report incidents (security events such as unauthorized access). The state shares threat information back	October 1, 2026
Use of communications data	The government analyzes communications data under independent oversight to find attack servers	Fall 2027
Access and neutralization measures	The police or SDF access servers used in attacks over the network and neutralize them	October 1, 2026

GMO is asking for the third part, access and neutralization.
Neutralization means deleting malicious programs placed on a server, or changing settings so the attacker can no longer use that server. It does not mean physically destroying the server (ITmedia NEWS, Japanese).
The government positions this as a new option alongside existing ones: alerts, takedowns (shutting down servers used in attacks), and public attribution (publicly naming the attacker).

The power to neutralize is in Article 6-2, which the companion act added to the Police Duties Execution Act, the law that sets out what measures police officers can take in their duties.
The SDF Act applies the same article to SDF units with some of its wording swapped, but the attacks covered and the conditions differ between the police and the SDF (text of the companion bill, Japanese).

	Police	SDF
Who acts	”Cyber harm prevention officers” designated by the Commissioner General of the National Police Agency	Units designated by the Minister of Defense
Attacks covered	Any wrongful act using information technology, such as acts that harm cybersecurity	Especially highly organized and planned attacks by actors outside Japan on critical computers (computers used by government agencies, critical infrastructure operators, and similar bodies whose failure would have a large impact) (SDF Act Article 81-3)
Conditions	When leaving the activity alone risks serious harm to people’s life, body, or property, and there is an urgent need	Ordered by the Prime Minister when there is a risk of serious disruption that would severely damage national security and the SDF’s special technology or information is indispensable, among other conditions, with a request or consent from the National Public Safety Commission. The actual measures follow the police article

Under a separate provision (SDF Act Article 95-4), the SDF can also take the same measures to protect computers of the SDF and U.S. forces in Japan.
Both SDF provisions have a narrow scope, so for this case, where ordinary people’s trading accounts were targeted, the provision that could apply is the police article, which has no such limit.

Why GMO can ask even though no foreign state attacked it

Active cyber defense is usually discussed in national security terms and is often taken to be a tool only for attacks by foreign governments.
But Article 6-2(2), the police neutralization clause, does not require the attacker to be a state.
The condition is that the police find communications or data used in a wrongful act using information technology, and that “there is an urgent need because leaving it alone risks serious harm to a person’s life, body, or property” (translated).

The protected targets are not limited to critical infrastructure or government computers either.
The term “critical computer” appears in paragraph 4, where it is used as an exception condition for skipping the prior approval of the independent body (the Cyber Communications Information Oversight Commission, which checks measures in advance).
On the text of the article, the police can neutralize an attack server when ordinary people’s property faces serious harm and there is an urgent need.

GMO’s fourth notice repeatedly stresses “citizens’ assets” and “citizens’ property,” probably to fit the “serious harm to property” condition.
The attackers’ threat to keep placing unauthorized orders could also support the “urgent need” condition.
GMO describes the attackers as “sophisticated cybercrime groups operating across borders” and does not say a foreign government is involved.
As of this writing, who carried out the attack has not been made public.

On the other hand, the law has no procedure for a private company to apply for activation.
The police decide whether to take neutralization measures, and if servers abroad are involved, the National Security Council reviews a response policy.
GMO’s request is not a legal application. It hands the government material for its decision, along with a clear message that GMO wants the measures used.

The government procedure for activation

On December 26, 2025, the government issued “Guidelines on the Operation of Access and Neutralization Measures” as a National Security Council decision (guidelines, Japanese).
The guidelines note that most cyberattacks on Japan come from abroad, and say measures against servers located abroad are expected.
The typical case they describe is a specific actor repeatedly attacking a specific organization or sector, such as the state or critical infrastructure, over a period of time with the same methods and attack infrastructure. The guidelines call this series of attacks a “cyberattack campaign.”

When the target server is abroad, the law requires that a National Police Agency officer, not prefectural police, take the measure (Article 6-2(3)), that the Foreign Minister be consulted in advance, and that the Cyber Communications Information Oversight Commission approve it.
The Cyber Communications Information Oversight Commission is a new independent body created by the active cyber defense legislation. It checks in advance whether a measure meets the legal conditions.
After a measure is taken, the administrator of the server is notified in principle (paragraph 8).

The guidelines add that when the target is abroad, the National Security Council reviews a response policy, and the National Cybersecurity Office then decides how the work is split between the police and the SDF under that policy.
Put together, the flow looks like this.

graph TD
  A["Need to neutralize an<br/>attacker server abroad"] --> B["National Security Council<br/>reviews response policy"]
  B --> C["National Cybersecurity Office<br/>splits work between police and SDF"]
  C --> D["Consult Foreign Minister<br/>via NPA Commissioner General"]
  D --> E["Prior approval by the Cyber Communications<br/>Information Oversight Commission"]
  E --> F["NPA officer accesses<br/>and neutralizes"]
  F --> G["Server administrator<br/>notified in principle"]

When there is no time to wait for approval, for example when communications causing serious failures in critical computers are being sent right now, the police can notify the commission afterward instead.
In this case the targets were ordinary people’s trading accounts, which is a different situation from that example.
Publicly available information as of this writing does not show circumstances that would allow skipping prior approval.

If the target server is in Japan, no consultation with the Foreign Minister is needed, and the National Security Council review only happens if the case is judged to involve national security.
Approval from the oversight commission is still required, but there are fewer steps than for a server abroad.
GMO describes the attackers as groups “operating across borders,” though, so their equipment may well be outside Japan.

The government’s response

As of 17:00 JST on October 24, no statement or announcement showing how the government would respond to GMO’s request could be found in news reports or on official websites.
October 24 was a Saturday, and GMO announced the request around noon the same day.

The closest statements from those running the framework date from September 30, the day before it took effect.
Prime Minister Takaichi posted on X that threats are hard to handle by the public sector alone, the private sector alone, or one country alone, and said Japan would work closely with like-minded countries and allies.
At a press conference, Chief Cabinet Secretary Kihara said the government would use the new council with critical infrastructure operators and the new incident reporting system to gather the information on attack sources needed for neutralization (ITmedia NEWS, Japanese).
The government expects information from the private sector to feed into neutralization, and GMO’s line in the fourth notice that it will “spare nothing in providing all logs and compromise information” (translated) looks like an attempt to fit into that flow.

Acting on servers abroad and international law

If Japanese police access a server abroad, it raises the question of the sovereignty of the country where that server sits.
Akihiro Yamaguchi, a researcher at Japan’s National Institute for Defense Studies (NIDS), writes that access and neutralization measures do not assume the exercise of self-defense against an armed attack.
He adds that because they are law enforcement against equipment abroad, they can conflict with the other country’s sovereignty. Countries disagree on which cross-border cyber operations violate sovereignty, so the measures could be judged a sovereignty violation (NIDS Commentary No. 394, Japanese).

Even if a measure violates sovereignty, international law has two doctrines that can remove its wrongfulness: countermeasures and necessity.
In GMO’s case, whether the attacker is a state decides which of the two Japan could rely on.

	Countermeasures	Necessity
Idea	Measures taken against another state’s breach of international law to make it stop	Exceptionally infringing another state’s rights to protect an essential interest from a grave and imminent peril
Precondition	A wrongful act by the other state	No wrongful act by the other state required
Non-state criminal groups	Cannot apply as is unless a state supports the group	May apply
Main requirements	Establishing the prior wrongful act, and proportionality to the harm	An essential interest, a grave and imminent peril, no other means, and no substantial contribution by the invoking state to the peril

For countermeasures, a fair number of states argue that a state that knowingly fails to stop private attacks launched from its territory breaches a duty of due diligence, which could justify countermeasures against that state.
The commentary notes this view, but says operators would face hard calls: whether the attack is attributable to a foreign government, and if not, whether it constitutes a breach of that duty.

According to the same commentary, the government’s expert panel recommended necessity as the easier ground to invoke in practice, because countermeasures require proving the other state’s wrongful act and proportionality to the harm.
On the “grave and imminent peril” requirement, the Netherlands government says mere disruption or inconvenience is not enough, and that situations such as a complete loss of internet access or serious damage to financial markets could qualify.
Germany and the Czech Republic also take the position that necessity can apply beyond physical damage, including cases like the loss of critical infrastructure functions.

The losses from unauthorized FX trades are large for each customer.
Whether they amount to the serious damage to financial markets that the Netherlands cited is another question. If Japan acts on servers abroad, it would have to explain to the international community why this harm qualifies.

If the attackers’ equipment is in Japan, no other country’s sovereignty is involved.
There is a close precedent. In April 2021 the U.S. FBI, with court authorization, remotely deleted web shells (backdoor programs attackers use to get back in later) left on private Microsoft Exchange servers in the U.S. that had been compromised through Exchange vulnerabilities (The Record).
The FBI only removed the web shells. It did not patch the vulnerabilities or remove other malicious programs.
The state entering private servers from outside and removing only the attack tools is similar in shape to Japan’s neutralization measures.

What is likely to happen

Neutralization will not bring back money already lost.
The article only allows deleting data on servers used in the attack and other measures affecting how those servers run, so stopping the attackers’ servers leaves balances already drained by unauthorized orders as they are.
Customers’ losses are handled through the compensation GMO announced.
GMO asks customers to contact their brokers about canceling the trades or getting refunds, and says it will pay whatever remains after any refund (4th notice, Japanese).

Neutralization could, however, stop further damage.
GMO has confirmed that customer information was taken out of its systems, and the attackers have threatened to keep manipulating accounts and to publish data.
If the servers placing unauthorized orders or the sites meant to publish the stolen data are identified, they could become targets for neutralization.
However, GMO has shut down all its servers and asked customers to change their passwords and terminate active login sessions, so manipulating the accounts will get harder over time.
GMO asks customers to terminate sessions as well because, even after a password change, a session that is still logged in can keep being used to place orders (3rd notice, Japanese).
The further these countermeasures go, the harder it becomes to argue that the “urgent need” in the article still exists.

If the attackers’ equipment is abroad, a National Security Council review, consultation with the Foreign Minister, and approval from the oversight commission are required.
The guidelines’ typical case is repeated attacks on the state or critical infrastructure, and a criminal group targeting the customers of a single private service falls outside it.
Whether the government will take action against servers abroad in an atypical case, less than a month after the law took effect, is unknown as of this writing.

The actual response may instead take the familiar takedown route: the police pursue the attackers through a criminal investigation, and sites carrying stolen data are taken down with help from foreign law enforcement and service providers.