GMO Internet disclosed on November 13 that compensation claims linked to a cyberattack on its foreign-exchange trading infrastructure had reached approximately ¥2.998 billion ($19.4 million), covering 2,943 trading accounts as of November 12. The Japanese technology company now expects about ¥3.05 billion in direct incident-related costs, with cyber insurance potentially covering only part of the bill.
The figures, presented during the company’s third-quarter earnings briefing, provide the first substantial estimate of the financial damage caused by the October attack on Onamae.com Desktop Cloud, a virtual private server (VPS) service widely used to run automated FX trading strategies.
GMO said compensation claims were submitted between November 6 and November 12. The amounts remain subject to verification, meaning the ¥2.998 billion represents requested compensation rather than confirmed payouts.
The company has cyber insurance with a maximum recovery of ¥1.1 billion, but coverage has not been confirmed. Even if the insurer pays the full amount, approximately ¥1.95 billion of the projected direct costs would remain uncovered.
Nearly 3,000 FX accounts report unauthorized trading losses
The compensation applications average approximately ¥1.02 million per account, although that figure does not indicate how losses are distributed among affected traders.
It is a claims figure, though, not yet a final bill.
GMO has committed to compensating realized losses directly attributable to unauthorized transactions, including related fees and transaction costs. Ordinary market losses, hypothetical trading profits and indirect damages are excluded.
The company is reviewing transaction histories and other records to determine which applications qualify. Payments will reflect confirmed losses, with any refunds already provided by brokers deducted to prevent duplicate compensation.
The new aggregate figure follows earlier reports of substantial losses among individual traders. DaveFinances previously documented an Osaka trader’s reported ¥1.8 million loss after unauthorized transactions appeared in her brokerage account during the attack.
Beyond trading losses, GMO has promised a flat ¥5,000 goodwill payment to customers using the affected service, regardless of whether they suffered financial damage.
As of November 12, 10,976 goodwill payment applications had been recieved, representing ¥54.88 million. The company estimates that these payments could eventually reach approximately ¥133 million, with applications remaining open until November 30.
GMO also plans additional compensation of up to ¥3 million for customers whose information has been publicly disclosed by the attackers. One customer had been identified as eligible for consideration under that arrangement.
Those payments come on top of the trading compensation process, and the various categories are not yet fully reconciled into final settlement amounts.
Insurance covers at most 36% of projected direct costs
GMO expects the incident’s direct financial impact to total approximately ¥3.05 billion, which it plans to recognize in the fourth quarter of 2026.
Its insurance policy provides a maximum potential recovery of ¥1.1 billion, equivalent to about 36% of that estimate. GMO is pursuing a claim but has not confirmed whether the insurer will accept it or how much will ultimately be paid.
There is insurance, yes, but no confirmed recovery yet.
The projected financial burden extends beyond compensation. GMO estimates that suspending Onamae.com Desktop Cloud will reduce quarterly revenue and operating profit by approximately ¥300 million each. Investigation expenses are expected to reach at least ¥60 million, while broader security improvements will involve additonal spending.
The company has not yet established the total cost of those measures or whether all related expenses fall within its insurance arrangements.
For investors, the ¥3.05 billion direct-cost estimate is substantial relative to GMO Internet’s recent profitability. The listed subsidiary reported ¥7.46 billion in operating profit for the first nine months of 2026, up 32.6% year over year, on revenue of ¥62.5 billion.
At approximately 41% of nine-month operating profit, the expected direct charge is larger than the subsidiary’s ¥2.7 billion operating profit in the July–September quarter.
These comparisons do not represent a forecast of fourth-quarter earnings, since insurance proceeds, other incident expenses and underlying operating performance have yet to be determined.
GMO has not revised its full-year earnings guidance, citing uncertainty over the verification of compensation claims, investigation costs and possible insurance recoveries. Its annual dividend forecast of ¥21.51 per share also remains under review in light of the potential financial impact.
The bill may yet change, and probably not all in one direction.
Five Japanese FX brokers reported affected customers
The attack was first identified in October when GMO discovered malicious software inside some customer server environments. The company suspended all Onamae.com Desktop Cloud plans on October 21 after determining that unauthorized access had occurred.
As DaveFinances reported in its initial coverage of the FX VPS shutdown, up to 26,739 server environments potentially fell within the affected scope. That number represented possible exposure, not confirmed compromises or unauthorized trading incidents.
The service allows traders to operate automated trading systems, including MetaTrader 4 and MetaTrader 5, continuously on remote servers.
Attackers obtained access to information within the hosting environment and used compromised credentials to execute transactions that account holders had not authorized. GMO subsequently confirmed that customer information had been taken outside its systems.
The incident also prompted action from Japan’s financial regulator.
In an October 27 statement on the unauthorized FX transactions, Japan’s Financial Services Agency identified five brokers that had reported customers potentially affected by the incident: Goldenway Japan, OANDA Japan, Ava Trade Japan, Gaitame Finest and Dukascopy Japan.
The regulator explained that GMO Internet operates as a server-hosting provider and therefore falls outside its direct supervisory jurisdiction. Nevertheless, it instructed FX brokers through the Financial Futures Association of Japan to strengthen transaction monitoring, warn customers and implement protective measures.
Those measures included resetting passwords, temporarily suspending affected accounts and blocking suspicious orders originating overseas.
The attack was on a hosting service, yet the trades were carried out through seperate brokerage accounts.
The FSA’s October 27 statement reported no newly identified unauthorized transactions at that time. It did not establish that every customer loss had been identified or that compensation investigations were complete.
Other brokers introduced their own remedies. BigBoss, for example, announced an additional 10% cash payment for qualifying GMO cyberattack losses, alongside restoration of certain trading bonus credits.
These broker-level arrangements are distinct from GMO’s compensation program, and the company has said any refunds affecting eligible claims will be taken into account.
GMO cuts executive pay as investigation continues
The November 13 earnings briefing also brought management accountability measures.
GMO Internet President Tadashi Ito announced a 25% reduction in his monthly remuneration for three months beginning in December. Executive Vice President Hiroshi Yamashita, responsible for systems, and senior executive Kimihiro Kodama, responsible for the domain and cloud business, will each take 20% reductions over the same period.
Management said it would revisit responsibility for the incident after completing further investigations and reviewing security deficiencies.
The company has also disclosed that attackers demanded approximately ¥8 billion in ransom on October 21, threatening further unauthorized trading and publication of customer information. GMO refused the demand.
According to its latest account, the attackers publicly released information concerning one customer on October 27, with no further confirmed disclosures reported afterward.
GMO Internet Group is conducting a broader cybersecurity review across its businesses, including AI-assisted vulnerability assessments. Group management indicated that an important phase of those checks was expected to conclude on November 14.
As for the original Desktop Cloud service, it remains suspended. No firm restart date, not yet.
The company has offered affected customers an alternative cloud environment, but the incident has already interrupted automated trading operations and created direct financial obligations extending beyond the hosting business.
The immediate financial assessment now depends on three unresolved amounts: the value of customer claims ultimately approved, insurance proceeds actually recovered and the final cost of investigation and security remediation.
GMO’s November 13 disclosure establishes the scale of the compensation requests and a preliminary direct-cost estimate. The final financial impact remains unconfirmed, while the company continues reviewing claims and preparing its fourth-quarter accounts.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.