GMO’s Late Apology: A Lesson in Data Breach Crisis Communication

GMO Internet Group CEO Masatoshi Kumagai apologized Monday at the company’s first public briefing since a cyberattack on its Onamae.com Desktop Cloud service put customer data in hackers’ hands. He admitted that a subsidiary had warned about weaknesses in the system in 2024. The briefing came 13 days after GMO confirmed that a malicious program had been planted on its servers, and those 13 days are a lesson in data breach crisis communication.

Here is my take. Too often, companies get into analysis paralysis and don’t move, and a lot of it has to do with internal politics. If someone makes the call and it sparks negative press, nobody wants to make that call. However, waiting is the worst choice of all.

It is so important to get out ahead of stories, especially in 2026, when you’re talking about AEO (answer engine optimization: showing up when people ask AI tools for answers). The first story that runs is usually the one that gets repeated across all the LLMs and search engines, and it’s more important than ever to get out ahead of things.

What Happened at GMO, Day by Day

The attacker got into the server on Aug. 5. GMO didn’t know until Oct. 20, a day after a customer asked about suspicious trades. Here is how the next two weeks played out, from GMO’s own notices and the coverage:

• Oct. 21: GMO began shutting down servers on every plan and received a ransom demand of about 8 billion yen.
• Oct. 24: GMO confirmed that the service had security vulnerabilities and that customer information had been taken, apologized and promised every customer 5,000 yen plus compensation for unauthorized trades.
• Oct. 25: Kumagai wrote on his personal blog (in Japanese) that the group’s own white-hat hackers had flagged problems with the service in advance, and that the response was neither deep enough nor fast enough.
• Oct. 27: The hackers’ noon deadline passed, and they posted what they said was one customer’s personal information. The Japan Times called it a high-stakes standoff.
• Nov. 2: Kumagai and his executives faced reporters for the first time.

To be fair, GMO was not silent. It posted 16 written reports by Oct. 29, refused to pay the hackers and offered compensation early. But for nearly two weeks, no executive stood in front of reporters and answered questions. In that gap, the hackers’ countdown and the CEO’s blog shaped the coverage. At the Nov. 2 briefing, Kumagai also apologized for his own social media posts, including a photo of him smiling, which he said may have hurt victims’ feelings.

Why Companies Wait: Analysis Paralysis and Internal Politics

Waiting feels safe inside a company. Nobody gets blamed for a statement that never went out. That is exactly the problem: the person who makes the call owns the headline, so the call doesn’t get made.

GMO’s own account shows how that plays out before a crisis, too. A cybersecurity subsidiary reported the vulnerabilities in April 2024, the company ran four rounds of emergency maintenance, and the report did not reach Kumagai, according to the company. Kyodo’s headline after the briefing: GMO “left system vulnerable for over 2 years.”

The bigger the company, the more people can slow a decision down. At Prism, we have been recognized for signing a Fortune 500 brand and a publicly traded streaming service, and our client list includes Nike, BMW, FedEx and P&G. When a company that size faces a crisis, legal, security, investor relations and the board all have a stake in the first statement. Each has a reason to wait for more facts. Somebody has to own the decision to speak.

Why the First Story Matters More in 2026: SEO and AEO

That is why the first story matters more now than ever. Your coverage drives SEO and AEO: showing up when people search on Google, and when they ask AI tools like ChatGPT, Claude and Gemini.

Muck Rack analyzed more than 25 million links cited by AI tools in its May 2026 “What Is AI Reading?” report. About 84% of citations came from earned media (a group that includes journalism, academic and government sources, and encyclopedic sites like Wikipedia). Among journalism citations with known publish dates, 57% were published within the last 12 months, and citations peak sharply in the first month after a story runs.

So the stories written in the first weeks of a crisis are the ones AI tools are most likely to cite. If those stories are built on a hacker’s countdown and a CEO’s blog, that is the version people get when they ask about your company. If they include your executive explaining what happened, what you are doing and what customers should do, your version is in the answer too.

What to Do on Monday: A Data Breach Crisis Communication Plan

You can’t stop every attack. You can decide now how fast you will speak.

1. Name who makes the call. Pick one executive who can approve a crisis statement within hours, with legal in the room. Decide it now, and you take the politics out of the moment.
2. Write the first statement before you need it. A holding statement says what happened, what you know, what you don’t know yet, what customers should do and when you will update them. Fill in the blanks in an hour, not a week.
3. Put a person in front of reporters early. Written notices matter, but an executive taking questions is what reporters quote. Do it in the first days, not the second week.
4. Own the failure in plain words. If you were warned, say so before a reporter finds out. Kumagai’s admission came on his blog and again at the briefing. It is stronger when it comes first and comes from the top.
5. Watch what your executives post. During a crisis, every post is part of the story. Clear personal social media with the communications team until it is over.
6. Send warnings to the top. Set clear rules for which security reports go to the CEO and the board. A warning that stops halfway up becomes a crisis later.

Frequently Asked Questions

What happened in the GMO data breach?

An attacker got into GMO Internet’s Onamae.com Desktop Cloud service, used for automated foreign exchange trading, on Aug. 5, 2026. GMO confirmed the attack on Oct. 20, shut down the service, refused a ransom demand and promised compensation. The hackers posted what they said was one customer’s data on Oct. 27, and the CEO held the first news conference on Nov. 2.

What should a company's first statement after a data breach say?

What happened, what you know and don’t know yet, what customers should do right now, what you are doing about it and when you will update them. Keep it plain, own what you know, and don’t guess at what you don’t.

Why does the first story matter for AI search?

AI tools lean heavily on earned media, including news coverage, and Muck Rack’s May 2026 report found that citations peak in the first month after a story is published. The early coverage of a crisis is the version AI tools are most likely to repeat.

Get Out Ahead of the Story

GMO did a lot right after it found the attack, including refusing the ransom and compensating customers. The lesson is about timing: waiting is the worst choice of all, and good data breach crisis communication is decided before the breach.

We are an award-winning, full-service PR agency, and we are also a digital PR and linkbuilding firm. Our crisis and reputation team helps companies get the first statement out fast, and we earn the coverage, with backlinks (a clickable link from a news story to your website, which lifts your Google ranking), that shapes what people find in search and AI answers. If you want a plan in place before you need it, talk to us.