Editorial: Cyberattacks on finance demand stronger public-private defenses in Japan

A cyberattack on a foreign exchange margin trading system run by a Japan-based company, GMO Internet Group Inc., has caused significant financial damage, according to an editorial. The servers managing customer information and transactions were reportedly taken over, leading to unauthorized trades and potential breaches of users' personal computers. The criminal group demanded a $1 million ransom, which GMO refused to pay.

The editorial highlights the increasing surge in attacks exploiting system vulnerabilities and points out that GMO had been aware of internal system issues but failed to act in a timely manner. GMO is urging the Japanese government to implement active cyber defense (ACD) measures, but ACD is currently a government responsibility, not something that private operators can initiate.

ACD involves government agencies, such as the police or Self-Defense Forces, entering compromised computers to neutralize the threat, with overseas servers and other systems potentially seen as acts of force. The editorial emphasizes the need for careful judgment in this matter.

Looking ahead, the editorial suggests that critical infrastructure companies, such as megabanks and electric power providers, may become targets as well. Given the centralized management of financial industry data in cloud systems, the risk of wholesale information theft is high. To mitigate this, the editorial advocates for distributed management instead.

Additionally, the editorial calls for stronger regulations to protect personal information, noting that current laws require companies to report and notify affected individuals but lack stringent penalties comparable to those found in Europe. The Prime Minister's administration plans to propose comprehensive cybersecurity measures and even consider revising the AI law, which currently promotes AI utilization. Ultimately, the editorial stresses the urgent need for risk assessment and policy adoption to prevent cyber abuse.