Lessons From the GMO Breach: What Government, Companies and Individuals Should Do Now

Hello, this is Ryuta Hamamoto from TIMEWELL.

On October 19, 2026, GMO Internet received an inquiry from a user about Onamae.com Desktop Cloud, a cloud-based PC environment used for things like automated forex trading. The investigation that followed showed that a third party had planted a malicious program. The number of servers that may have been affected is 26,739. Login details for trading accounts and other information were obtained, and trades the users did not recognize were made in their accounts¹².

About three weeks have passed. The attacker demanded roughly 8 billion yen and published part of the information. The company has said it will not comply, the government has moved to put together emergency measures, and it was reported that telecom carriers were asked to block the attacker's site. On November 2 the company's representative held a press conference, apologized, and explained that the response to a warning received two years earlier had not been sufficient³⁴.

I think it would be a waste to file this away as something that happened to a big company. Every company has "weak spots that are hard to notice." And this incident also makes us think, all at once, about what the government should do, what companies should do and what we as individuals should do.

In this article I first lay out, in time order, what happened, limited to what I could confirm from GMO's official announcements and press reports. Then I look forward and write about what to do next, split across three roles (government, companies and individuals), in words a beginner can follow. At the end I list concrete actions you can take today. To be clear, this is not an article that blames the company that was hit. Its purpose is to turn the regrets the company itself voiced at its press conference into something other companies can learn from.

Key points

• According to the company, this was not a flashy event like a defaced website. The attackers got into customers' environments, used administrator privileges as a foothold and spread to the company's internal management servers. It took about two and a half months from intrusion to discovery⁵³.
• The regrets the company named at its press conference are lessons for other companies as they stand: it could not make full use of an outside expert's warning, the bar for escalating important reports was vague, and monitoring did not catch the anomaly, so it came to light only through a user's inquiry⁵³.
• The government has three jobs: help the companies that are hit, quickly; stop the attackers' infrastructure; and set rules that stop secondary harm. The government is expected to adopt an emergency countermeasure package on November 6⁶⁷.
• Companies should protect administrator privileges, never leave a warning unattended, build the ability to detect intrusions, hold fewer secrets on behalf of customers, and decide their policy on extortion in advance.
• Individuals should stop reusing passwords, turn on two-step verification, check their transaction history, and not visit sites where leaked information is posted.

Terms to get straight first

News coverage uses terms that are a little unfamiliar. Here are the words used in this article, put into everyday comparisons.

Term	In everyday terms
Cloud-based PC environment (desktop cloud, VPS)	A service that puts your home PC on a company's server on the far side of the internet, so you use it remotely. Think of placing your work desk in a rental storage unit
Administrator account (privileged account)	The authority of the person who holds the key ring for the whole building. If one is stolen, every room opens
Management server	What the operator uses to manage every user's environment. Think of it as the building manager's office
Ransomware	A malicious program that encrypts the data on a computer without permission and demands money in exchange for restoring it
Vulnerability	A weakness in software or a system, like a design mistake in a door lock
Active cyber defense	A national initiative to catch signs of an attack early, before being hit, and to stop the equipment being used in the attack, rather than responding only after the fact. It began in October 2026
Blocking	A telecom carrier cutting the connection to a particular site
Secrecy of communications	The rule, set by the Constitution and the Telecommunications Business Act, that a carrier must not look at or disclose who communicated with whom without permission

What happened

The timeline

GMO has kept publishing on the "Important Notices" page of its official site, from the first report on October 21 through the 16th report on October 29. On October 30 it also issued guidance for users. Below I build the timeline mainly from facts confirmed in the company's official announcements, adding the explanations given at the press conference and press reports¹²⁸⁹.

Date	What happened
April 24, 2024	At the press conference it was explained that an expert at a group company had reported points to improve in the service3
April 26 to May 20, 2024	Emergency maintenance was carried out four times. The company explained that the "depth and speed" of the measures fell short53
August 5, 2026	According to the press conference, intrusion into customers' remote desktops began and an administrator account was stolen53
August 17	It is said that, using that privilege, the attacker got into the company's internal management server53
September 20 to October 14	According to Jiji Press's detailed press conference report, malware was distributed through this management server3
October 19	An investigation began after an inquiry from a user1
October 20	A malicious program was confirmed, and new applications and the control panel were suspended1
October 21	From 4 a.m. the servers of all plans were shut down in sequence, and the first report was published. The same day, a threatening email is said to have been received (a demand of about 8 billion yen)18
October 22	The company consulted the police. The second report announced that 26,739 servers might have been affected1
October 24	The fourth report announced confirmation that information had been taken outside. It decided on condolence payments, compensation for losses and a replacement service, and asked the government to apply active cyber defense2
October 26	It was reported that the government would hold a ministerial meeting and that the Prime Minister would instruct the compilation of emergency measures10
October 27	The attacker published part of the information about the company and its customers (one item by the company's confirmation). It was later reported that, with the same date on the document, the Ministry of Internal Affairs and Communications asked telecom carriers to block the attacker's site31112
October 28	The company announced that the attacker's site had been taken down (stopped). A site offering a reward for information about the culprit was also opened812
October 29	The company announced that it had obtained promising information that could lead to identifying the culprit8
November 2	The company's representative held a press conference, apologized and explained what happened4
November 5	Tips submitted for the reward reached a cumulative 8398

What was damaged

The service hit was one used as a dedicated VPS for automated forex trading, among other purposes. The number of servers that may have been affected is 26,739, and every plan was in scope. Information stored on the servers, in particular login details for trading accounts saved in trading tools (such as MT4 and MT5), is said to have been obtained by a third party. The company explains that it did not hold payment information such as credit card details on this service's servers¹.

On the user side, reports of trades in trading accounts that users did not recognize came in one after another from October 21. At the press conference it was explained that the attacker used customers' automated forex trading account information to execute trades designed to produce losses³.

The service has stayed down since the shutdown on October 21, including at the time of the press conference. The company decided not to resume it on the current system platform that was breached, and to renew its security foundation. For contract holders who want to keep using a service, it has pointed them to a replacement service on an independent cloud platform and says it will be free for six months after the switch².

The attacker's moves and the company's policy

The attacker kept up demands for money and threats. According to the company's fourth report, the attacker named continued improper operations on trading accounts at more than 70 securities and forex firms in Japan and abroad, publication of information about users' PCs connected to the service, ransomware attacks on those PCs, and publication of information about the company's systems and operating structure. The amount demanded is reported to be about 8 billion yen (50 million US dollars)²¹¹.

The company has said it will not comply with the demand. The reasons include that paying does not guarantee the deletion of the information or the prevention of its misuse. It has handed evidence such as communication records to the police and asked for a criminal investigation². On October 27, after the noon deadline the attacker had set, part of the information was published. By the company's confirmation, however, no ransomware damage to users' PCs had been found at that point. It also says that some of what was published may contain things that differ from the facts¹¹.

The company has repeatedly asked users to refrain from accessing suspicious sites and from reposting or spreading the URLs or contents of what is posted on social media or elsewhere. The reason is that information about users who visit such a site may be obtained by the attacker¹³¹¹. For the damage, the company has prepared two separate things: compensation for losses from improper trades (limited to trades recognized as improper; losses from market movements are excluded), and a uniform condolence payment of 5,000 yen to every user².

The regrets the company named at its press conference

At the press conference on November 2 the company itself listed several points of regret. This is the part that can serve other companies as a lesson just as it stands.

The first is how it handled a warning from outside. In April 2024 an expert at a group company reported points to improve in the service. The company carried out emergency maintenance four times between April 26 and May 20, but the "depth and speed" of the measures fell short, and two years went by without a fundamental fix, it explained⁵³.

The second is the reporting mechanism. The warning is said not to have reached the company's representative, and to have been shared up to the vice president level. The company named the lack of a clear standard for reporting to the board as a problem and says it will review the reporting mechanism⁵.

The third is the ability to detect intrusions. The intrusion had begun in August, but the company learned of the situation only on October 19, through a user's inquiry. The company said it takes it seriously that service monitoring did not catch the anomaly⁵³.

The fourth is a change in thinking. The representative said that the biggest problem was that the shift from the idea of "cybersecurity" to "resilience (the ability to recover)," which the industry has been stressing, came too late³.

As a way of taking responsibility, a reduction in pay for four officers including the representative was also announced (the representative's monthly pay cut by 30 percent for three months)⁴. As far as I could confirm, details of concrete measures to prevent recurrence have not yet been published.

Why this is not someone else's problem

Some of you may think, "even a company of that size." But the weaknesses visible here are not limited to large companies.

One is that warnings from outside experts or from staff inside the company simply stop. When a warning is received, the person in charge starts work. But when a fundamental fix needs a lot of money or time, it is easy to push it back with "we're busy now" or "another service comes first." And if the path by which that warning reaches executives is narrow, it stays stopped.

The other is a design in which administrator privileges, once broken in one place, spread to everything. Administrator privileges stolen from a user's environment, then used to reach the company's internal management server. This flow could happen in the system of any company, whatever its size.

The government has shown the same concern. A document for businesses issued on November 5 by the National Cybersecurity Office in the Cabinet Secretariat asked for thorough basic measures in operating websites and mobile apps. Managing contractors, taking inventory of entrances you expose, multi-factor authentication for management functions: these overlap with what we can learn from this incident. I go through it in our article explaining the document's 13 pages for executives.

For the new national framework behind this incident, see our article on active cyber defense.

What the government should do

Now to the main subject. I start with the government's role. I think there are three big things the government should do.

1. Help the companies that are hit, quickly and in a coordinated way

A company that is hit has to do many things at once: investigate the cause, shut down and restore services, tell users, consult the police, design compensation and hold a press conference. GMO kept updating its official announcements through the 16th report in about ten days. Few companies could do all of this on their own.

The government is moving on this point. According to press reports, a "Cybersecurity Emergency Countermeasure Package" is expected to be adopted at the ministerial meeting on November 6. The draft reported as of November 5 has four pillars. The first is thorough basic measures using AI (a "top gun talent team" of highly skilled specialists to be launched within the month, strengthening public and private defenses through attack testing). The second is a stronger system for gathering and analyzing information (working with leading AI companies to obtain unpublished vulnerability information early). The third is strategic handling of attacks (a new "outreach team" in the National Cybersecurity Office that contacts organizations at risk of harm and urges them to take measures). The fourth is support for victims and prevention of spreading damage⁶⁷.

The centerpiece of the fourth pillar is the "public-private cyber rescue team (provisional name)." Made up of public and private specialists, it would be dispatched to support initial response when an organization that has been hit requests help and the situation is urgent. For serious attacks, a plan has also been reported to dispatch a "joint response team (provisional name)" made up of the National Cybersecurity Office, the ministry in charge, the police, and the Ministry of Defense and Self-Defense Forces⁶.

I think this direction is right. But whether it is actually useful will be decided by how it is run. For example, is there a single contact point that a company in trouble calls first in the middle of the night? Can a small company ask for help without worrying about cost? Will the name of the company that asked be kept from going public without its consent? These points need to be checked in the official announcement after the decision.

2. Stop the attackers' infrastructure

However hard a company that is hit tries, the same attack continues as long as the attacker's base keeps running. Only the state can handle this part.

On October 24, GMO asked the government to make this incident the "first activation" of active cyber defense. Under the current system, though, there is no procedure by which a company applies to trigger it. The decision to act is made by the police and the Self-Defense Forces in light of the law. As I laid out in the earlier article, the government's response was cautious.

I think it matters a great deal to build, as part of the system, an entrance through which a company that has been hit can tell the state, "please help us." It is fine for the state to decide whether to act. But if it states in advance what it will judge by and how soon it will answer when a request arrives, a company that has been hit can see whether it can count on the state.

3. Set the rules that stop secondary harm

This time another big issue surfaced: how to stop the attacker's site where leaked personal information is posted.

According to press reports, the Ministry of Internal Affairs and Communications, in a document dated October 27, asked telecom carriers through four industry bodies, including the Telecommunications Carriers Association, to block connections to the attacker's site. The carriers have not said whether they actually blocked it. In the end, on October 28, the site's domain was stopped and could no longer be viewed¹².

The difficult part is the secrecy of communications. For a carrier to block connections to a particular site, it must mechanically check where its users are connecting, and that itself is said to touch the secrecy of communications. At NTT's earnings briefing on November 4, President Shimada was reported to have said that blocking is a case where both "user protection" and "secrecy of communications" must be satisfied, and to have asked that guidelines for emergency evacuation be prepared and that legislation be advanced¹⁴.

GMO's representative, Mr. Kumagai, presented a personal view at the November 2 press conference, which he called the "Cyber Aegis concept." It says Japan should create a system in which, when the source of malicious traffic from abroad is detected, carriers are asked to block it. He said the law should be changed so that the Ministry of Internal Affairs and Communications can respond while respecting the secrecy of communications¹⁵.

The legal and technical points of this concept are discussed in detail by the attorney Masakazu Masujima in a note article ("How to Make 'Stopping Bad IPs' Work")¹⁶. His framing is that the technical parts are largely in place, and what is missing is a system that decides what is to be stopped, who judges it and bears responsibility, and who protects the carriers that comply. It is technical, but if you are interested, please do read it.

In my own words, for beginners, I think it comes to this. The faster you stop something, the faster the effect spreads when you stop the wrong thing. So you need brakes as much as you need speed. Narrow down what may be stopped. Put a cap on how long it can be stopped. Create a way to correct mistakes. Keep records of judgments and actions. Have an independent body watch over it. Democratic countries all write brakes like these into their laws. I think Japan should start the discussion before the next incident happens.

What we can expect from government, on one page

What the government should do	What is moving now	What I am watching
Help companies that are hit, quickly	Emergency countermeasure package, public-private cyber rescue team, joint response team (all at the press-report stage)	A single contact point, cost for small businesses, confidentiality
Stop the attackers' infrastructure	Active cyber defense (in force since October 2026)	An entrance for a hit company to ask for help, and the standard of judgment
Set rules that stop secondary harm	Request from the Ministry of Internal Affairs and Communications (administrative guidance), discussion in industry bodies	Legal protection for carriers that comply, and independent oversight

What companies should do

Next, what you should do as a single company. I have connected the regrets GMO named at its press conference with the basic measures that the government document asks for, and sorted them into seven. All of them can be thought about today, whatever the size of your company.

1. Protect administrator privileges

At the center of the company's explanation in this incident is that administrator privileges were used as a foothold.

First, count how many accounts with administrator privileges exist inside your company: employees, contractors and system accounts. You will probably find more than you expected. Then check these four things.

• Do administrator accounts have multi-factor authentication (a second kind of proof in addition to the password, such as a confirmation code on a smartphone)?
• For everyday work, do people use an account with ordinary privileges rather than an administrator one?
• Are the people and devices allowed into management servers limited?
• Are accounts for contractors whose work has ended still around?

A management server is, so to speak, the building manager's office. You must avoid a situation where the key to the manager's office is lying on the tenants' floor. Consider also designing the management-side network and the user-side network separately.

2. Build a process that does not let warnings sit

The second is probably the most important. The company named its handling of the 2024 warning as a regret.

Whether the warning comes from an outside diagnosis, an internal staff member, a business partner or an audit, decide these three things.

• Who is responsible for responding (a named person)
• By when it will be fixed (a deadline)
• To whom, and how, you report when it cannot be fixed by the deadline

With these three settled, warnings are less likely to be left alone. The third, reporting, matters most. The company said the standard for reporting to the board had not been clear. Decide in advance the "bar for taking it to executives." For example: a weakness confirmed to be exploited, a weakness involving customer information, and a serious weakness still open past its deadline must always go to executives. Just having a bar like that reduces the number of warnings that stall.

I think the "deadline and reporting" part is for executives to decide themselves. If one staff member decides alone, they are pushed around by how busy the field is.

3. Build the ability to detect intrusions

The intrusion began on August 5, and the company learned of the situation on October 19. For about two and a half months, the attacker was moving without being noticed.

The ability to detect splits broadly into two.

One is on the system side. Logins to management servers, access at unusual hours, large data extraction and the distribution of new programs: it is a mechanism that records these movements as logs and watches them. A company without dedicated staff can also choose to hand monitoring to an outside specialist provider.

The other is on the human side. This time, the first to notice was a user's inquiry. Having a channel through which a user's "something seems off" reliably arrives is a fine detection mechanism in itself. Build a flow in which the person who receives that voice does not keep it to themselves but connects it to people who investigate and people who decide.

4. Hold fewer secrets on behalf of customers

This time, the login details for trading accounts stored on users' servers were targeted. The more secrets you hold, the bigger the damage.

Review whether your service really needs to hold customers' passwords and credentials. If it does, decide how to store them (encryption, limits on who can access them), how long to keep them, and how to delete them when they are no longer needed. Anything you keep holding "because it's convenient" increases the size of the damage just as it is.

5. Prepare for extortion

In ransomware attacks, a demand for money and a threat to publish information can arrive together. That was the case this time too.

At the moment you are threatened, calm judgment is difficult. That is exactly why, in peacetime, you write the following five things on paper.

• Who makes the first decision when a threat arrives
• Whom to contact at the police, and in what order to consult
• How to preserve evidence (emails, communication records, logs)
• The company's basic policy on a demand for money (pay or do not pay)
• What to tell customers first, and when

GMO said it would not comply, because paying does not guarantee the deletion of the information or the prevention of its misuse. What matters is whether your company can hold a decision like that in advance. If the basic policy is set, you can decide faster on the very day you are hit.

6. Give users information quickly and accurately

This time the company updated its official announcements through the 16th report in about ten days. In the second report of October 22, the extent of the leak and misuse had not yet been determined, and in the fourth report of October 24 it was revised to say that the taking of information outside had been confirmed. As the investigation advances, the facts change. By the nature of an incident, that cannot be avoided.

I think three points matter.

• Separate what is known from what is not yet known
• Say concretely what users should do right now (change passwords, check trading history and so on)
• Warn about opportunistic fraud at the same time

GMO's second report organized its requests to users into six items and stated plainly that the company never asks for a password by email or phone¹. Users who have just been hit decide things while anxious. Concrete actions and a warning about fraud protect them.

7. Anticipate compensation and support in advance

A company that is hit has to decide on compensation and support for users: what, how far, and for whom. By October 24 GMO had decided on compensation for losses, a uniform condolence payment, a replacement service, and six months free of charge².

If you only think about compensation design after being hit, it takes time. Just having a rough outline in peacetime changes the speed of your first response: the scope of your insurance (cyber insurance), where you draw the line between what is covered and what is not, and the documents needed for verification.

Three things executives can do this week

You do not need to do all seven at once. If it were me, I would start with these three.

1. List the accounts that hold administrator privileges, and check whether multi-factor authentication is in place
2. Make a list of warnings received from outside or inside, and check whether each has a deadline and an owner
3. Write on one sheet of paper who to contact when you are hit, and who makes the first decision

As an entry point for gauging your understanding, the AI literacy check is also available. For how to act when an incident actually happens, see our article on first response, and for preparation on PCs and endpoints, the checklist for small and medium-sized businesses. For protecting APIs that handle member information, our article on the Sourcenext incident is also a useful reference.

What individuals should do

Finally, a word about each one of us. This matters even to people who do not use GMO's service, because incidents like this will keep happening.

What users in this incident should do

GMO asks users to take the following actions¹. If you used the service and have not done these yet, please do them right away.

1. Change the passwords for your trading tools and trading accounts from a device other than this service
2. After changing them, disconnect your sessions (the logged-in state)
3. Check your trading history and balances, and if you find a trade you do not recognize, contact your broker
4. Set up two-step verification if your broker offers it
5. If you saved IDs, passwords or similar on the server, change them promptly. If you use the same password on other services, change those too
6. Be alert to opportunistic phishing emails, suspicious contacts and websites

Number 1, "change them from a device other than this service," matters in particular. If you change a password inside an environment that may have been breached, the new password may be stolen too.

Five habits that help everyone

Even if you did not use the service, these five are useful right away.

Do not reuse passwords. A password leaked from one service is tried by attackers on other services. Use a different password for each service, and leave what you cannot remember to a dedicated password manager app.

Turn on two-step verification, or passkeys. Start with the services where damage would be greatest: finance, email, social media and cloud. Even if your password leaks, no one gets in right away.

Do not leave important credentials sitting in someone else's environment. This time, users who had saved their trading account login details on a PC in the cloud were harmed. In exchange for convenience, are you keeping secrets for a long time in a place someone else manages? Take another look.

For services that involve money, check the history regularly. The sooner you notice a trade you do not recognize, the smaller the harm. If there is a notification feature, turn it on.

Beware of opportunists. After an incident, emails and calls pretending to be about "compensation procedures" or "password confirmation" increase. A company never asks for your password by email or phone. For a contact you do not recognize, open the official site yourself and check.

Do not go to the site where leaked information is posted

There is something very important in this incident. The company has repeatedly asked people to refrain from accessing suspicious sites and from reposting or spreading their URLs or contents¹³.

The wish to check whether your own information is posted is a natural one. But visiting the site helps the information spread, and information about the person who visits may be obtained as well. When you are worried, do not look for the site. Contact the support desk the company has announced. If you find a new attacker site, or a site where personal information is being published improperly, report it to the reporting contact the company has announced.

Whom to contact if you are hit

If you notice improper trades or a leak of information, act in this order.

1. Contact the operator of the service that was hit (this time, your broker and GMO)
2. Consult the police (the police consultation line is #9110)
3. If you feel you have been the victim of fraud, consult the Consumer Hotline (188)

As evidence, keep your transaction history, emails and screen records without deleting them.

Connecting the three roles

So far I have taken government, companies and individuals one at a time. Finally, here is how the three connect.

Role	Job	In one line
Government	Help companies that are hit, stop the attackers' infrastructure, set rules that stop secondary harm	Takes on what is out of reach for any single company
Companies	Protect administrator privileges, never leave warnings unattended, build detection, hold fewer secrets, prepare for extortion	Guard their own entrances and the secrets they hold
Individuals	Passwords and two-step verification, checking history, not spreading information	Guard their own entrance and do not widen secondary harm

If any one of them is missing, the whole is weaker. Even if the government builds a system, intrusions cannot be prevented if companies do not protect administrator privileges. Even if companies do their best, attackers can come in through another entrance if individuals reuse the same password. Even if individuals are careful, leaked information spreads if the government has no way to stop secondary harm.

Closing

What I felt most strongly from this incident was the ability to notice, and the ability to keep moving.

It took about two and a half months from the start of the intrusion until the company noticed. After it noticed, in about ten days the company issued 16 announcements, decided on compensation, prepared a replacement service, worked with the police, and even set up a reward. I think we should see it fairly: the company that was hit kept moving.

On the other hand, the story of the response to a warning two years ago is a very quiet problem that could happen to any company. When a warning comes from outside, few people may feel at once that it is a serious matter. But while that warning stands still, time sides with the attacker.

"Is there something we were warned about and still have not fixed?" After you finish this article, please ask that inside your company. If the answer does not come right away, start there. Government, companies and individuals do not need to become perfect all at once. Moving one thing forward today makes the next harm a little smaller.

If warnings do not move inside your company, or you want to put in order the sequence of judgment calls for when you are hit, our WARP SECURITY is also an option. It is a training program that spends its time on everyday preparation, such as internal approvals and judgment calls at the moment of discovery, rather than on explaining attack techniques. You can reach us through a consultation request.

References

The facts here are based on GMO's official announcements, press reports and government-related materials as of November 6, 2026. As far as I could confirm, the cause of the incident and the full extent of the damage have not yet been established. The government's emergency countermeasure package rests on press reports from before the decision (the draft as of November 5), and its content needs to be checked in the official announcement after the decision.

Footnotes

1. [Important] Apology and Notice Regarding Unauthorized Access to "Onamae.com Desktop Cloud" (Second Report) — GMO Internet Group — October 22, 2026 (Japanese) ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹

2. Apology and Notice (Fourth Report) — GMO Internet Group — as of 11:50 a.m., October 24, 2026. Includes the condolence payments, compensation for losses, replacement service and the request to the government (Japanese) ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸

3. [Press Conference Report] GMO's Kumagai: "We Could Not Protect Our Customers," Citing the Rapid Advance of AI, "Criminals Are Polluting the Internet" — Jiji Press — November 2026 (Japanese) ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³

4. GMO Chairman Kumagai Apologizes Over the Unauthorized Access Problem — Impress Watch — November 2, 2026 (Japanese) ↩ ↩² ↩³

5. GMO Could Not Resolve a Vulnerability From Two Years Ago; "Unauthorized Access Received in August" — Nikkei — November 2, 2026 (Japanese) ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸

6. "Cyber Rescue Team" to Be Created; Government Emergency Measures to Be Decided on the 6th — Jiji Press — November 5, 2026. A report on the plan before the decision (Japanese) ↩ ↩² ↩³

7. Public-Private Team for Cyberattacks, to Be Dispatched to Companies to Support Initial Response (Kyodo News distribution) — Okinawa Times — November 5, 2026. A report on the draft before the decision (Japanese) ↩ ↩²

8. Current Response (16th Report) — GMO Internet Group — October 29, 2026. Includes additions up to November 5 on the number of tips submitted for the reward (Japanese) ↩ ↩² ↩³ ↩⁴ ↩⁵

9. Important Notices (list of the first to 16th reports and others) — GMO Internet Group (Japanese) ↩

10. Government to Hold Ministerial Meeting on the Evening of the 26th on Cyberattack Response; Prime Minister to Instruct Emergency Measures — Nikkei — October 26, 2026. An article on the meeting's schedule, and it contains no conclusion (Japanese) ↩

11. "Onamae.com Desktop Cloud" Unauthorized Access (Follow-up Including the Ninth and 10th Reports) — Impress Watch — October 27, 2026 (Japanese) ↩ ↩² ↩³ ↩⁴

12. Ministry of Internal Affairs and Communications Asks Carriers to Block GMO Attacker's Site, Reports Say — ITmedia NEWS — October 30, 2026. The request is based on reports in newspapers, and no official confirmation from the Ministry has been shown (Japanese) ↩ ↩² ↩³

13. Guidance for Customers — GMO Internet Group — October 30, 2026 (Japanese) ↩ ↩²

14. Reports That the Ministry of Internal Affairs and Communications Made a "Blocking Request" to Industry Bodies Over GMO Internet's Information Leak: Did NTT Act? — ITmedia Mobile — November 5, 2026 (Japanese) ↩

15. "I Want to Talk to the Takaichi Government": GMO's Kumagai Raises a Cyber Defense Concept, "The Social Disruption Is Still the Prologue" — Sankei Shimbun — November 3, 2026 (Japanese) ↩

16. Masakazu Masujima, "How to Make 'Stopping Bad IPs' Work: Thinking About the Cyber Aegis Concept," note, November 6, 2026 (Japanese). The organization of the technical and legal points of the concept is the author's own view. This article limits its mention to introducing those points. ↩