GMO's Urgent Request for 'Active Cyber Defense'; Government Official Says It's Not a System That Activates Upon Request

What happened

GMO Internet's cloud service was hacked. On October 24, the company said it would pay for losses that individual investors suffered in foreign exchange (FX) trading because of the hack. The company also said it had asked the government to use "active cyber defense," a new law that took full effect on October 1. Under this power, police or the Self-Defense Forces can enter the server that is attacking and shut down the attack. Officials stressed that the government decides for itself whether the conditions are met. It does not act simply because a single company asks.

Key facts

• The new active cyber defense law took full effect on October 1, 2026.
• The power can be used when serious harm could happen if nothing is done, or when a foreign government is behind a well-planned, organized attack.
• Police carry out most actions. The Self-Defense Forces work with police on especially advanced attacks from overseas.
• In most cases, an independent body, the Cyber Communication Information Monitoring Committee, must approve the action first. In emergencies, it can be reported afterward.
• For servers outside Japan, the foreign minister must also be consulted first.

What is "active cyber defense"?

Usually, defenders wait for an attack and then respond. This power is different. It lets authorities go into the attacking computer and stop or delete the attack program. The goal is to stop harm before it spreads. Ideally, the government also spots warning signs before an attack starts. In GMO's case, the attack had already happened, so officials said the power may not help much after damage is done.

Why it matters

The case shows a gap between what companies expect and how the law works. Officials worry that publicly announcing the request could reveal how Japan defends itself. Some people are also confused about how the government will respond to requests from companies. The government says it will not announce case by case whether it used this power.

What to watch

• Whether the government decides to use active cyber defense in the GMO case.
• How the government explains its rules to companies that want help during attacks.
• How the independent committee handles approvals and emergency reports under the new law.