Prime Minister Sanae Takaichi told a ministerial cybersecurity meeting in Tokyo on Monday that Japan will compile an emergency response package by the end of next week, after a string of corporate intrusions—including the GMO Internet Group breach of its Onamae.com desktop cloud service—exposed customer credentials and fueled unauthorized foreign-exchange trades.
Takaichi said the situation is "serious," with growing anxiety that leaked personal data will be weaponized in secondary fraud. She instructed ministries to expand consultation desks run by the Information-technology Promotion Agency and police, strengthen supply-chain monitoring that reaches small firms, and prepare to deploy every lawful countermeasure—including access and neutralization steps against attacker infrastructure once investigations clarify who is responsible.
GMO breach pushes 'active defense' debate
GMO confirmed unauthorized access to servers powering Onamae.com, a cloud environment used for FX and other trading tools. A customer flagged suspicious transactions on 19 October; engineers found malware the next day, yet reports of unrecognized trades continued even after servers were taken offline midweek. CEO Masatoshi Kumagai apologized for ignoring warnings from in-house white-hat testers and said the company would reimburse trading losses while paying 5,000 yen to every affected customer.
On Saturday GMO asked the government to invoke Japan's new Active Cyber Defense framework, which took effect on 1 October and allows state-led disruption of hostile servers. Cabinet officials note the law targets national security infrastructure, not ad hoc private requests, but Kumagai argued that tolerating the attack would invite copycats against retail investors.
What the emergency package is meant to fix
According to the Prime Minister's Office readout, Economy Minister Ryosei Akazawa will scale the "cybersecurity rescue squad" for small businesses, while Digital Minister Toshiharu Furukawa expands vendor participation in the national Cyber Conference to improve threat telemetry. Ministries must funnel sectoral incident reports to the National Cybersecurity Center for analysis and targeted public warnings.
Kyodo News reported that Defense Minister Shinjiro Koizumi joined the session, underscoring that breaches against retailers and cloud hosts are now treated as cabinet-level contingencies, not IT desk tickets. Takaichi also demanded that ministries use the AI Safety Institute to run accelerated vulnerability checks on government systems, mirroring the private-sector red teams she wants IPA to fund.
Household stakes beyond the headlines
NHK World noted that unauthorized trades hit ordinary account holders, not only corporate balance sheets. That shift—from data theft to direct wallet damage—explains why Takaichi is racing a one-week deadline despite ongoing criminal probes. Furukawa will coordinate with allies to attribute attacks that cross borders.
For Tokyo traders and regional suppliers still recovering from earlier leaks, the package is a promise of hotlines, red teams and, when legal thresholds are met, state action against command-and-control servers. The test will be whether those tools arrive before the next wave of automated fraud cashes out stolen credentials.