Key takeaways
- Two big breaches this autumn came with payments to the people affected. Park24 will pay ¥3,000 to each of the 1.46 million Times Car customers whose ID images were sent out. GMO Internet will pay ¥5,000 to every user of its hacked trading VPS, cover trading losses, and now pay ¥10,000 to ¥25,000 for each category of a customer's data the attackers publish.
- Japanese companies have long sent apology payments (お見舞金) after large breaches, usually a ¥500 voucher: Yahoo! BB in 2004, Benesse in 2014. These are gestures, separate from compensation for actual losses.
- Japanese courts award little for leaked basic details: from about ¥1,000 to ¥6,000 per person in the Benesse and Yahoo! BB cases. Sensitive data is worth more: ¥35,000 in the TBC esthetic salon case.
- Times Car customers are pushing back. A lawyer plans a group lawsuit, with more than 100,000 people registered, seeking ¥50,000 for each person whose ID images leaked and ¥30,000 for others, calling ¥3,000 far too low.
- GMO's scheme is new: it sets a price per category of data, rising with sensitivity, which is how Japanese courts weigh privacy harm. In our view, it is a model other companies may be asked to match.
- For practitioners, payments are now part of incident response. Decide in advance who decides, on what criteria, and how to pay without creating a new channel for phishing.
Two kinds of payment#
Japanese breach notices use two words that are easy to confuse in translation:
- お見舞金 (omimaikin), an apology or sympathy payment: a flat amount sent as a gesture, usually without any claim or proof of harm. It is not a legal admission of the amount of damage.
- 補償 (hoshō) or 損害賠償 (songai baishō), compensation or damages: payment for a specific loss, such as money taken from an account, or an amount set by a court.
GMO's response this month uses both. Its flat ¥5,000 is an apology payment; the realized losses from unauthorized trades are compensation. The new per-category payments for published data are called a special apology payment.
What companies have paid#
| Year | Company | Breach | Payment |
|---|---|---|---|
| 2004 | SoftBank (Yahoo! BB) | 4.52 million records of broadband customers | ¥500 in vouchers to every member, whether or not their data leaked |
| 2014 | Benesse | 28.95 million records of education service customers | ¥500 voucher (electronic gift or book voucher), or a donation to a children's foundation set up from a ¥20 billion fund |
| 2026 | GMO Research & AI (infoQ) | 894,082 survey panel members | ¥2.87 million of members' points stolen and converted to gift codes, credited back |
| 2026 | Park24 (Times Car) | 6.63 million accounts; encrypted ID images sent out for 1.46 million | ¥3,000 in cash or vouchers to the 1.46 million whose images were sent out; ¥5.5 billion special loss |
| 2026 | GMO Internet (Onamae.com Desktop Cloud) | Up to 26,739 trading servers; logins used to trade; data being published | ¥5,000 to every current user; realized trading losses compensated; ¥10,000 to ¥25,000 per category of published data |
Most of the other breaches on our list of 2026 breaches of a million records or more have come with an apology and a warning about phishing, but no payment, in the notices we have read.
Times Car: paying for one kind of data#
Park24's payment is targeted. It goes only to customers whose encrypted ID images, mostly driver's licenses, were sent out, not to all 6.63 million whose accounts were taken. Asked by ITmedia how it reached ¥3,000, Park24 said it had considered the steps customers might take to protect themselves, the burden involved, and how people use identity verification and fraud-prevention services. It did not give a formula, and it has not decided whether to pay in cash, gift cards or points.
By our arithmetic, ¥3,000 for 1,465,349 people is about ¥4.4 billion, most of the ¥5.5 billion special loss. Park24 has since decided it never needed to keep those images after sign-up.
Times Car: a lawsuit over ¥3,000#
The payment has not settled the matter. A lawyer who opened a website in September to gather plaintiffs said on October 23, the day Park24 announced the ¥3,000, that he intends to sue, according to Kyodo News. At a press conference on October 26, the plaintiffs' counsel said more than 100,000 people had registered, according to ABEMA TIMES. The planned suit, in the Tokyo District Court, would name Park24, its subsidiary Times Mobility and two of their representative directors personally, and seek:
- ¥50,000 for each person whose ID images leaked
- ¥30,000 for everyone else affected
- Actual costs, such as fees for checking credit bureau records and reissuing driver's licenses
Counsel called ¥3,000 far too low for the risk of impersonation and the distress involved, and argued that keeping license images for up to seven years after customers left conflicted with the privacy law's requirement to delete data that is no longer needed. Counsel also said registrants had reported more than 3,300 cases of misuse, including loans and credit cards taken out in their names. Those are the plaintiffs' figures; Park24 has not commented on them, and no suit had been filed as of October 27.
GMO: a price list#
GMO's twelfth report sets a payment for each category of a customer's data that it confirms the attackers have published:
| Category of published data | Payment |
|---|---|
| Basic information, such as name and contact details | ¥10,000 |
| Financial and authentication information, such as trading account IDs and passwords | ¥15,000 |
| Sensitive or special-care personal information | ¥25,000 |
Amounts for different categories are added together. GMO gives a cap of ¥3 million per publication, but has not explained how it applies, since the three amounts add up to ¥50,000. The payments come on top of the ¥5,000 and compensation for trading losses, and GMO says it may revise them if the attackers change what they publish.
What Japanese courts award#
Few people sue, and those who do usually win small amounts. Under Japanese law, the main claim for leaked personal data is 慰謝料 (isharyō), consolation money for mental distress, and courts weigh how sensitive the data is and whether any further harm followed.
| Case | Data | Court award per person |
|---|---|---|
| TBC (esthetic salon), leaked 2002 | Names, contact details and survey answers about body measurements and concerns | ¥35,000 for 13 plaintiffs with secondary harm, ¥22,000 for one (Tokyo District Court, 2007). They had asked for ¥1.15 million each |
| Yahoo! BB, 2004 | Names, addresses, phone numbers, email addresses | ¥6,000 (Osaka District Court, 2006), reduced to ¥5,500 on appeal and upheld by the Supreme Court in 2007 |
| Benesse, 2014 | Names, addresses, birth dates of parents and children | In 2017 the Supreme Court overturned a ruling that had found no damage and sent the case back; the Osaka High Court then awarded ¥1,000 (2019). In a group suit, the Tokyo District Court awarded ¥3,300 each to 462 plaintiffs (2018). Other courts dismissed claims |
Two things follow. First, a company's flat payment of a few thousand yen is in the same range as what a court would award for basic details. Second, the amounts are too small to make suing worthwhile for most people. Japan has no US-style class action for this; in 2026, the privacy regulator dropped a proposal to let qualified consumer organizations sue on people's behalf, as we explained in our article on the privacy law amendment. The Times Car suit is an attempt to do it anyway, by gathering more than 100,000 individual plaintiffs; each must still sign up and take part.
Our view#
GMO's price list follows the logic of the courts. It pays more as the data becomes more sensitive, which is how Japanese courts have weighed privacy harm since TBC. Its amounts are higher than courts have awarded for basic details, and it pays without anyone having to sue. That is generous. It also sets a public benchmark: after a future breach, customers and the media may ask why a company is paying less than GMO's ¥10,000 for a name and contact details.
The Times Car suit will test whether ID images are worth more. The plaintiffs' ¥30,000 to ¥50,000 is far above the ¥1,000 to ¥6,000 courts awarded for basic details in the Benesse and Yahoo! BB cases, and closer to the ¥35,000 in TBC, where the data was sensitive and plaintiffs showed further harm. In our view, the outcome will depend on the same two factors: whether a court treats a driver's license image as highly sensitive, and whether plaintiffs can link actual misuse, such as the loans counsel describes, to this breach. Either way, it will take years; TBC took about four.
Payments follow concrete risk, not record counts. Park24 pays for ID images, which can be used to open accounts or take out loans. GMO pays for trading losses and for data the attackers are actually publishing. Companies that lost email addresses, even tens of millions, have not paid. In our view, that is a defensible line, but it should be drawn on purpose, before an incident, not decided under pressure.
Keeping data has a price you can now see. Most of Park24's ¥5.5 billion follows from images it now says it did not need to keep. As we argued in our article on what apps should not keep, data minimization is the cheapest control there is.
The payment process is a phishing opportunity. Every "your compensation is ready" message after a breach invites fakes. GMO already warns customers that it will never ask for passwords and to ignore anyone offering to "recover losses" for a fee. Paying through an existing account, such as points or a balance in the service, avoids asking for bank details by email.
What this means for practitioners#
- Add payments to your incident response plan. Decide who has authority to approve an apology payment or compensation, and which criteria apply: the type of data, whether misuse is likely or confirmed, and whether there is a measurable loss.
- Separate gestures from compensation. Be clear in notices whether a payment is an apology or compensation for a specific loss, and what happens to further claims.
- Plan the logistics. Former members, people with outdated contact details and people without bank accounts are the hard part. Points or credits inside the service are simpler and safer than bank transfers, where they fit.
- Check your cyber insurance. Policies differ on whether they cover apology payments, compensation and the cost of running a payment program. Find out before you need it.
- Count the data you keep. A payment per affected person turns every unnecessary record into a liability. ID images, old accounts and data on former customers are where that cost concentrates.
Japanese terms at a glance#
| Japanese | Reading | Meaning |
|---|---|---|
| お見舞金 | omimaikin | Apology or sympathy payment |
| お詫び | owabi | Apology |
| 補償 | hoshō | Compensation (for a loss) |
| 損害賠償 | songai baishō | Damages |
| 慰謝料 | isharyō | Consolation money for mental distress |
| 金券 | kinken | Voucher, gift certificate |
| 特別損失 | tokubetsu sonshitsu | Special (extraordinary) loss |
| 集団訴訟 | shūdan soshō | Group lawsuit |
| 適格消費者団体 | tekikaku shōhisha dantai | Qualified consumer organization |