GMO Internet has urgently asked the Japanese government to deploy active cyber defense measures following unauthorized access to servers used for automated FX currency margin trading. The request brings together a corporate security incident, reports of losses on users’ trading accounts and a government system that began operating on Oct. 1. GMO said on Saturday that it would compensate users for losses arising from unauthorized transactions following the incident.

A total of 26,739 servers may have been affected, making that the principal measure of the incident’s possible reach. That figure describes servers, not users, accounts or transactions, and remains qualified: it is not a confirmed count of servers compromised. Some users have reported losses from transactions they did not authorize. No monetary value for those losses is provided in the available information, leaving the financial consequences less clearly defined than the potential extent of the server exposure.

The government’s active cyber defense system involves the Self-Defense Forces and police entering an attacker’s server pre-emptively to disable it and avert damage. Operations under that system started on Oct. 1, before GMO’s request was reported on Oct. 24, 2026. The company is therefore seeking action through a system already in operation, rather than asking Japan to establish an entirely new mechanism in response to its incident. Whether that system will be used in this case remains unspecified.

Read more: Ukraine's Starlink speeds recover after disruption lasting a week

The distinction between the access incident and the reported trading losses is important to understanding what has been established. GMO has disclosed unauthorized access to its servers. Separately, some users have reported losses from unauthorized transactions on their accounts following that incident. The information available does not set out a technical sequence connecting the server access to individual transactions. It supports reporting both developments, but not a more detailed account of how particular accounts were affected.

Likewise, the server figure provides a measure of possible exposure rather than a complete assessment of harm. It cannot be read as a count of users entitled to compensation or as evidence that every potentially affected server was used to conduct an unauthorized trade. The distinction matters because the available information combines a broad statement about servers with a narrower description of users reporting losses. Neither the number of those users nor the number of disputed transactions is supplied.

GMO’s compensation commitment addresses losses from unauthorized transactions following the incident, while its appeal for active cyber defense concerns measures intended to prevent damage. These are different parts of the response: reimbursement deals with financial consequences, whereas the government system is designed to act against an attacker’s server. The available account gives no timetable or payment procedure for compensation. Nor does it specify how individual claims would be assessed, beyond the company’s commitment to cover losses from unauthorized transactions following the incident.

Read more: U.S. reduces embassy staffing as warnings of Iranian threats intensify

The request also separates the company’s role from that of public authorities. GMO has disclosed the intrusion and promised compensation; the active cyber defense operations described are carried out by the Self-Defense Forces and police. Asking for those operations does not establish that the authorities have agreed to intervene. No government response to GMO’s appeal is provided, and there is no confirmation that an attacker’s server associated with this incident has been entered or disabled under the system.

There is no stated opposing view in the available account, whether from officials, affected users or other parties. The substantive contrast is instead between the company’s urgent call for intervention and the limited information about any official action in this particular case. An assessment of the request must preserve that distinction. The existence of an operational government system explains what GMO wants deployed, but does not itself establish the authorities’ position on the company’s appeal or the outcome of any consideration.

Important details about the incident remain outside the disclosed information. It does not identify an attacker, give a date for the unauthorized server access or describe the means used to obtain access. Those omissions limit conclusions about responsibility and the precise circumstances that prompted the request. The reported chronology establishes the start of government operations and the subsequent public account of GMO’s appeal, but it does not establish when the intrusion began or how long it lasted.

The next points to clarify are therefore the government’s response, the confirmed extent of server access and the implementation of compensation. Those developments would help distinguish potential exposure from established damage and a request for intervention from an actual operation. For now, GMO’s position is clear: it wants Japan to use active cyber defense following the intrusion and has undertaken to compensate users for losses from unauthorized transactions following the incident. The scale of those losses and the official response remain unspecified.