Kai Hirota

6 min read1,269 words

#gmo-breach#policy#japan

GMO breach, part 4: Japan's new privacy fines law does not cover breaches like GMO's

The first penalty Japan's privacy regulator can impose on its own was enacted in July 2026. It applies to 4 kinds of violation and charges a company only what it gained, so a breach caused by careless security goes unpunished.

日本語版

On July 10, 2026, Japan's parliament passed the first penalty the privacy regulator can impose on its own: a surcharge, a sum it can order a company to pay without going to court. It applies to 4 kinds of violation and charges the company what it gained from them. A breach caused by negligent security is not among the 4.[1] Less than a month later, attackers got into a service run by GMO Internet, a Japanese internet company. From August 17 they held an administrator account on the GMO computer that controlled thousands of customers' rented machines, and from late September they used it to install malicious software on them.[11] The only price anyone at the company has paid so far is a 3-month pay cut: 30% for the chief executive and 20% to 25% for 3 other executives.[2]

What the new law does#

Timeline from July 2026 to July 2028. The law is passed on July 10, 2026, and published on July 17. The intrusion into GMO begins on August 5 and is found and disclosed on October 20 and 21. The cabinet order and guidelines are still to be drafted and put to public comment. The surcharge rules are in force by July 2028.

The amendment to the Act on the Protection of Personal Information was enacted on July 10, 2026, published on July 17, and takes effect on a date the cabinet will set within 2 years, so by July 2028 at the latest.[1] Its surcharge provisions, in the summary published by the Personal Information Protection Commission, the privacy regulator, work like this:[3]

  • The Commission can order a surcharge for 4 kinds of conduct: improper use of personal information, improper acquisition, passing data to other companies without the required consent, and misusing the exemption that lets companies combine customers' data for statistical research without asking permission.
  • The order is available only when the data of more than 1,000 people is involved.
  • The amount equals what the company earned from the violation, for example the price it was paid for the data. A repeat within 10 years multiplies it by 1.5; self-reporting halves it.

None of the 4 covers failing to secure data. Even if one did, the surcharge equals what the company earned from the violation, and a company earns nothing from being breached, so there would be nothing to charge.

Flowchart: would the new surcharge apply to a breach like GMO's? First question: is the violation one of the 4 covered acts, namely improper use, improper acquisition, passing data on without consent, or misusing the statistics exception? A security failure is not, so the answer is no and there is no surcharge. Only if yes: are more than 1,000 people affected, and did the company receive money for the violation? A breach earns the company nothing to take back. Only then is the surcharge that amount.

What a breach costs elsewhere#

Australia had its 2 largest data breaches of 2022 at the telecom Optus in September[4] and the health insurer Medibank a few weeks later.[5] Within months, parliament raised the maximum penalty for a serious or repeated privacy breach to the greatest of 3 figures: A$50 million, 3 times what the company gained, or 30% of its revenue over the period of the breach. The new maximum took effect on December 13, 2022.[6] It does not reach Medibank, whose conduct ended in October 2022. The regulator is suing Medibank in the Federal Court over 9.7 million people's data under the old cap of A$2.22 million per breach.[5]

The European Union's privacy law, the GDPR, sets administrative fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher, for breaches of its core principles, including the duty to process data securely and to collect only what is necessary.[7] In the United States the rule is about disclosure rather than fines. Since July 2023 the Securities and Exchange Commission, the stock-market regulator, has required a listed company to tell investors about any cyber incident it judges serious enough to matter to them, in a public filing, within 4 business days of reaching that judgement.[8] GMO disclosed the day after it found the malware,[14] which would have satisfied the American rule. Japan's privacy law also sets a deadline, but for a report to the regulator, not to the public: a first report within 3 to 5 days of discovery.[15] Announcing the breach publicly was GMO's own choice.

What GMO faces#

The measures GMO has announced so far, from its own disclosures:

  • Pay cuts of 30% for the chief executive and 20% to 25% for 3 other executives, for 3 months from December, with further measures to depend on an internal review.[2]
  • A reward of up to US$1 million in total, the same figure as the attackers' last demand, for information leading to the attackers, funded by GMO itself.[9]
  • A request to the government, on October 24, to invoke Japan's new "active cyber defence" law, which came into force on October 1 and lets the state access and neutralise attacking servers. The government's reply was that whether it acts does not depend on a company asking.[10]

The regulator cannot fine GMO for leaving the warning unaddressed for 2.5 years. The privacy law requires companies to protect personal data, but all the regulator can do is order a company to improve. Only ignoring that order is punishable, and the July law does not change this.[12]

Why neglect is rational#

In 2024, the finding from GMO's own security company reached 3 executives and went no further, because no rule required them to pass it on. Ignoring it cost GMO almost nothing: there was no fine and no outside review. When the breach came, GMO spent its press conference talking about the attackers, not the warning. Part 2 explains why the warning carried no weight inside GMO.

What Japan's privacy law should add#

  1. Penalties tied to revenue, including for negligent security. Add inadequate security measures to the list of conduct that can draw a surcharge, and set the amount as a share of revenue rather than of gains, because a breach has no gains.
  2. A duty to report upward. Require that security findings from internal or commissioned audits be reported to the board within a fixed period, with the board's response recorded in the minutes. GMO's legal head said no standard for this existed;[13] make one mandatory.
  3. Detection requirements. Require companies to watch who signs in with full control over systems that hold customer data, and to check those records regularly. Under such a rule, 64 days of an intruder holding full control of the server that managed every GMO customer's machine[11] would itself be a violation.
  4. A duty to collect only what is needed. Add the GDPR's rule that a company may collect only the data its stated purpose requires to Japan's privacy law, and let the regulator enforce it.

References#

  1. のぞみ総合法律事務所, 2026年（令和8年）改正個人情報保護法の概要（第1回）. Enactment on July 10, 2026, promulgation on July 17, 2026 as Law No. 56, and the commencement schedule.
  2. セキュリティ対策Lab (Rocket Boys), GMO、サイバー攻撃で熊谷正寿氏ら役員4人が報酬減額, November 2, 2026.
  3. 個人情報保護委員会, 個人情報保護法等の一部を改正する法律について（政令・規則委任事項）, October 14, 2026. Articles 148-3 to 148-7 and the surcharge summary.
  4. Office of the Australian Information Commissioner, OAIC statement on Optus data breach, September 22, 2022.
  5. Office of the Australian Information Commissioner, Medibank civil penalty action overview.
  6. Corrs Chambers Westgarth, Higher penalties and other Privacy Act amendments commence, December 2022.
  7. Article 83 GDPR, General conditions for imposing administrative fines, paragraph 5.
  8. U.S. Securities and Exchange Commission, SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies, July 26, 2023.
  9. ビジネス+IT, GMO攻撃、「有力情報」を警察へ提出…懸賞金に270件、総務省は強制遮断を要請と報道, October 29, 2026.
  10. 熊本日日新聞（共同通信）, GMO、サイバー防御を緊急要請 不正アクセス確認、適用なら初, October 24, 2026; Impress Watch, GMO、政府に能動的サイバー防御の適用を要請, October 2026.
  11. @IT, 「ネットのセキュリティもGMO」の実態 イエラエの事前指摘はなぜ放置されたか：GMO記者会見を読む, November 3, 2026.
  12. Japanese Law Translation, Act on the Protection of Personal Information (Act No. 57 of 2003), Article 23 (security control measures) and Chapter VI on the Commission's recommendations and orders.
  13. ITmedia Business Online via Yahoo! News, 「31年間『もうける』と言ったことはない」GMO熊谷代表、不正アクセスで謝罪も露呈した“組織の壁”, November 2, 2026.
  14. GMO Internet Group, 【重要】「お名前.com デスクトップクラウド」への不正アクセスに関する現在の対応について（第9報）, October 27, 2026, with the first report dated October 21, 2026.
  15. Personal Information Protection Commission, 漏えい等の対応とお役立ち資料 (deadlines for breach reports to the Commission).