Japan Lets Police Hack Attack Servers as GMO Requests First Use

Japan's new "active cyber defense" framework has its first potential test case. On October 24, 2026, GMO Internet announced that it had asked the government to invoke the system after a cyberattack on its "Onamae.com Desktop Cloud" service.

Since October 1, 2026, Japanese authorities have been allowed to access servers used in attacks and remove the threat directly. Until now, cyber defense meant largely defensive work: blocking intrusions, cutting off suspicious traffic and restoring damaged systems.

How the "access and neutralization" measure works

The new tool, called access and neutralization measures, lets officials identify a server used in an attack, access it and stop or delete malicious programs. The aim is to prevent serious damage or keep it from spreading, for example when attackers keep launching new strikes from different servers against a target such as a power plant.

Police carry out the work. In sophisticated, organized attacks from abroad, the Self-Defense Forces may assist. The law sets conditions, including cases where inaction could endanger lives or property and urgent action is needed. Prior approval from an independent third-party body, the Cyber Communications Information Oversight Commission, is the general rule.

Caution is built in because attack servers are often not owned by the culprits. Hijacked computers belonging to ordinary companies or individuals can serve as relay points, and shutting them down could disrupt unrelated services.

The GMO case

The attack on GMO Internet exposed customer information, and a person believed to be the attacker demanded money. GMO asked for the incident to be treated as the first activation of active cyber defense, requesting that the government trace and disable the servers used.

On October 26, Chief Cabinet Secretary Kihara said the decision on whether to act does not depend on company requests but on the legal requirements. He declined to comment on individual responses, saying details could inform attackers. On October 28, GMO said the domain of a site the attackers used to publish information had been stopped. It remains unclear whether the government carried out an access and neutralization measure.