FX自動取引がハッキング？GMOで不正アクセス発生！？
A survey found 76% of economists support expanding the 30% out-of-pocket medical cost requirement to more elderly patients, as Japan's healthcare finances buckle under demographic pressure. Car-sharing service Times Car (タイムズカー) suffered a data breach affecting 6.6 million accounts, with the operator announcing ¥3,000 consolation payments for the 1.46 million users whose driver's license images were accessed. Separately, unauthorized access to GMO Internet's VPS service allowed hackers to hijack FX auto-trading accounts and engineer deliberate losses, with GMO pledging full compensation for confirmed damages.
Listen to this episode Go to the show page
What this episode answers
How is the elderly medical cost burden proposed to change, and what do economists think of it?
76% of economists surveyed support expanding the 30% co-pay requirement to a broader elderly population. The current system sets co-pays at 20% for ages 70–74 and 10% in principle for those 75 and older, with an outpatient monthly cap of ¥22,000, so the change would not produce a sudden large increase for most patients.
How does Japan's demographic outlook relate to the growing strain on healthcare finances?
The working-age population (ages 15–64) has fallen roughly 15 million from its 1995 peak of approximately 87.59 million to about 72 million today, while the share of people 65 and older has doubled from 15% in 1995 to around 30% now, with national healthcare spending ballooning from ¥2.5 trillion in 1970 to ¥48 trillion at present.
What happened in the Times Car data breach, and is the ¥3,000 consolation payment appropriate?
6.6 million accounts were leaked in September, and of those, 1,464,800 users whose driver's license and other identity images were confirmed to have been accessed and externally transmitted will receive ¥3,000 in cash or gift certificates; industry norms for data-breach consolation payments run ¥500–1,000 per case, making ¥3,000 higher than the typical range.
How were FX auto-traders victimized in the GMO VPS unauthorized-access incident?
Hackers accessed FX trading accounts through compromised VPS servers and used thinly traded minor currency pairs to deliberately generate losses in the hijacked accounts by acting as the counterparty to those trades; FX auto-trading platforms often do not support two-factor authentication, a gap the attackers exploited.
How does the GMO incident connect to past online brokerage hijacking cases in terms of method?
In spring 2025, multiple online brokerage accounts were mass-hijacked and used to buy large volumes of Chinese small-cap stocks, inflating prices before the attackers sold for profit—a scheme structurally similar to this incident, though any connection to the Chinese government in either case remains unconfirmed.
Expanding the 30% Elderly Medical Co-Pay — 76% of Economists in Favor
A survey conducted by Nikkei Inc. and the Japan Center for Economic Research found that 76% of economists support expanding the 30% out-of-pocket co-payment requirement to a wider share of elderly patients. The Ministry of Health, Labour and Welfare launched formal discussions in October on revising the elderly medical insurance system.
Under current rules, patients aged 70–74 pay 20%, while those 75 and older pay 10% in principle—rising to 20% above a certain income threshold and 30% for those with working-level incomes. Only about 7% of elderly patients currently fall into the 30% bracket. The monthly outpatient cap sits at ¥22,000 for the 10% and 20% tiers, and at ¥12,000 or ¥8,000 for residents exempt from municipal taxes—a structure sometimes compared to a subscription service. One quirk of the system: dividend and interest income from accounts with source withholding elected is excluded from health-insurance premium calculations, meaning it is technically possible for someone earning tens of millions of yen annually in dividends from a large portfolio to remain in the 10% co-pay tier.
Healthcare Finance Under Pressure — Shrinking Workforce, Growing Elderly Population
Japan's working-age population (ages 15–64) peaked at roughly 87.59 million in 1995 and has since fallen to about 72 million—a decline of approximately 15 million people. The share of the population aged 65 and older stood at 7% in 1970, climbed to 15% by 1995, and now stands at around 30%. National healthcare expenditure has followed a steep trajectory: ¥2.5 trillion in 1970 (about ¥24,000 per capita), roughly ¥26–27 trillion by 1995 (¥214,000 per capita), and ¥48 trillion today (nearly ¥400,000 per capita). While Japan's per-worker productivity has held up reasonably well, the structural problem is clear: the absolute number of contributors is shrinking while the number of beneficiaries keeps growing.
Times Car Data Breach — 6.6 Million Records Leaked, ¥3,000 Payments for 1.46 Million, ¥5.5 Billion Special Loss
In September, Park24 Group's car-sharing service Times Car (operated by Times Mobility) disclosed a data breach exposing the account information of 6.6 million users, including names, addresses, dates of birth, phone numbers, email addresses, and driver's license data. On October 23, the company announced that 1,464,800 users whose identity verification images—including driver's licenses—were confirmed to have been accessed and transmitted externally would receive ¥3,000 in cash or gift certificates. The company expects to record approximately ¥5.5 billion as a special loss to cover response costs.
Industry norms for data-breach consolation payments generally run ¥500–1,000 per affected account. The Yahoo! BB incident in 2004 (roughly 4.5 million accounts, ¥500 gift certificates), the Benesse incident in 2014 (also ¥500 gift certificates), and most court-ordered damages have settled in the few-hundred to few-thousand yen range. At ¥3,000, Times Car's payment is on the higher end of that spectrum. For context, after the 2004 Japanet Takata (ジャパネットたかた) breach involving roughly 500,000 accounts, the company suspended sales operations for about 50 days—absorbing an estimated ¥15 billion in lost revenue—in a bid to rebuild customer trust.
GMO VPS Unauthorized Access — FX Auto-Trading Accounts Hijacked, Full Loss Compensation Pledged
On October 21–22, GMO Internet announced that its rental server service "Onamae.com Desktop Cloud" (VPS) had been subjected to unauthorized third-party operation. A total of 26,739 servers are believed to have had user data exposed. Among those affected were FX traders who used the VPS to run automated trading systems; some have reported losses of several million yen after their accounts were taken over.
The attack method exploited minor currency pairs. By trading thinly traded currencies against each other and using a hijacked account as the counterparty, the hackers were able to deliberately drain funds from the victim's account into positions they controlled. FX auto-trading systems frequently lack two-factor authentication support, a vulnerability the attackers specifically targeted.
A similar scheme emerged in spring 2025, when a wave of online brokerage accounts were hijacked and used to purchase large volumes of Chinese small-cap stocks—effectively pumping the share prices before the attackers liquidated their positions. Whether the same actors or the Chinese government were involved in either incident has not been established.
GMO has announced a flat ¥5,000 consolation payment to all affected users, and has committed to fully compensating any realized trading losses attributable to the unauthorized access. The company has stated it will not negotiate with or pay any ransom to the attackers.
Takeaways
- 76% of economists support expanding the 30% elderly medical co-pay, against a backdrop of national healthcare costs that have grown roughly 19-fold since 1970 to ¥48 trillion while the working-age population has shed 15 million since its 1995 peak.
- Times Car's ¥3,000 consolation payment for 1.46 million accounts—out of 6.6 million total leaked—is above the industry norm of ¥500–1,000 per case, though actual exfiltration of driver's license images has not been fully confirmed.
- GMO's VPS breach enabled FX account hijacking through minor-currency counterparty manipulation, exploiting the absence of two-factor authentication in auto-trading systems; GMO has pledged full compensation for confirmed losses.
This article is edited from a machine transcript of the first 30 minutes of the episode. It is not an official summary — please listen to the episode itself.