Japanese internet infrastructure company GMO Internet will compensate customers for financial losses linked to unauthorised trading following a cyberattack on its cloud service. The company will also pay ¥5,000 (€28) to every customer currently using the affected service, regardless of whether they suffered losses.

The attack targeted Onamae.com Desktop Cloud, a virtual private server service that allows customers to access remote desktop environments. GMO said customer information had been stolen and some users had reported transactions in their securities and foreign-exchange accounts that they had not authorised.

According to founder and chief executive Masatoshi Kumagai, the incident potentially affected 26,739 servers and involved unauthorised activity on trading accounts held with more than 70 securities and foreign-exchange firms in Japan and overseas.

GMO shares fell almost 16% on Monday, reaching a four-month low. The company had a market value of approximately $2.6 billion at Friday’s close.

GMO began investigating the incident on 19 October after receiving an inquiry from a customer. The company confirmed the installation of malicious software in some customer server environments the following day. It then suspended new applications and access to the service’s control panel before beginning to shut down all servers on 21 October to limit further damage.

In a blog post published on Sunday, Kumagai apologised for the company’s handling of the incident. He acknowledged that security specialists had identified concerns before the attack but said the company’s response had been insufficient.

GMO also disclosed that it had received a ransom demand from a party believed to be responsible for the attack. In an update to his blog on Monday, Kumagai said the attackers had demanded $50 million in cryptocurrency and threatened to release company and customer information.

The company has refused to pay the ransom and is cooperating with police and other authorities.

Customers who wish to continue using a Windows desktop environment will be offered an alternative service operating on independent cloud infrastructure, free of charge for six months. GMO also plans to redesign its security architecture and investigate the breach with external experts.

Kumagai has called on the Japanese government to strengthen its active cyberdefence capabilities, arguing that private companies cannot tackle sophisticated cross-border attacks alone. GMO has asked authorities to consider applying the framework to the incident and offered to share evidence and technical information with investigators.

The breach comes amid wider concerns about digital security, following the disclosure of two critical vulnerabilities in PHP, a programming language widely used to build websites and applications. Security authorities warned that the flaws could allow malicious code to run on vulnerable servers, although GMO has not confirmed any connection between those vulnerabilities and the attack.

A separate Google Cloud outage in the United Kingdom last week disrupted online services, including those operated by financial technology company Revolut, highlighting the wider consequences of disruptions to digital infrastructure.

The European Commission has accepted an action plan from Chinese-owned online retailer Temu to address violations of the European Union’s Digital Services Act (DSA), following a €200 million fine imposed on the company in May.

The Commission said on Monday that Temu had committed to strengthening its safeguards against the sale of illegal products and improving its monitoring procedures. The company has also agreed to conduct a risk analysis and take additional measures where necessary to address potential problems on its platform.

Temu will review how its product recommendation systems may contribute to the spread of illegal goods, the Commission said. The measures are intended to strengthen consumer protection and ensure the platform meets its obligations under EU digital regulations.

The fine was imposed in May after regulators found that Temu had failed to adequately identify and address risks associated with illegal and unsafe products sold to European consumers. Examples included dangerous baby toys and faulty chargers.

The penalty followed a formal investigation launched in October 2024 into whether Temu was complying with the requirements imposed on designated Very Large Online Platforms under the DSA. These platforms are subject to stricter rules because of their reach and potential impact on users.

Temu welcomed the Commission’s approval of its action plan, describing the regulatory engagement as constructive.

“We appreciate the Commission’s constructive engagement with us throughout the process,” the company said in a statement.

The plan, Temu added, demonstrated its commitment to investing in compliance systems and creating a safe and trustworthy shopping environment for customers across the EU.

The retailer has around 130 million users across the bloc’s 27 member states, representing nearly one-third of the EU population. Its extensive customer base has made it a major player in Europe’s online retail market, while also bringing increased scrutiny from regulators concerned about product safety and compliance.

Temu is also adapting to changes in the EU’s treatment of low-value imports. Since July, a €3 fee has applied to low-value packages entering the bloc, affecting retailers that ship large volumes of inexpensive goods directly to consumers. Previously, parcels worth less than €150 could enter the EU without customs duties.

The new charges have contributed to a decline in small-parcel imports, particularly from China. Reports indicate that such imports have fallen by between 30% and 40% since the measures took effect.

The acceptance of Temu’s action plan marks another step in the EU’s efforts to tighten oversight of major online marketplaces, although the company’s implementation of the promised measures will remain important to its compliance with the bloc’s rules.

Parents in France are underestimating how frequently their children use artificial intelligence, while many say they lack the support needed to guide them towards responsible use, according to a new YouGov survey commissioned by Berlin-based non-governmental organisation Interface.

The survey found that 40% of children aged 11 to 12 use general-purpose AI services, such as ChatGPT, every week. However, only 26% of their parents were aware of this use, a gap of 14 percentage points.

The research, conducted online between June 24 and 30, included 1,138 parents of children aged 11 to 17 and 970 children in the same age group. It examined the use of several AI technologies, including chatbots, digital companions, voice assistants and AI features built into social media platforms.

The findings suggest that AI tools are becoming part of children’s lives at an early age. Among respondents aged 11 to 12, 56% said they used at least one type of generative AI tool weekly. General-purpose AI services were used by 40%, while 33% reported using voice assistants. Another 23% used AI features embedded in social media, and 16% said they interacted with AI companions.

Jessica Galissaire, a senior policy researcher at Interface, said AI chatbots could function like always-available companions because they do not tire and may consistently agree with users. She also raised concerns about younger children accessing services whose age requirements they do not meet. Character.AI, for example, requires users in the European Union to be at least 16 years old.

The survey found that parents consistently underestimated AI use across age groups. Among children aged 13 to 15, 62% reported regular use, compared with their parents’ estimate of 52%. For teenagers aged 16 to 17, the figures were 70% and 61%, respectively.

Time spent using these services was another concern. According to Galissaire, 92% of generative AI users said they spent more time on the technology than they intended. AI companions and AI features integrated into social media recorded particularly high levels of unwanted extended use, at 59% and 57%, respectively.

Parents also reported limited support in helping their children navigate AI. Only 32% felt sufficiently supported, while 26% said they received some support but not enough. The remaining 42% said they received no support at all.

When asked who should help protect and educate children about AI, 51% of parents identified teachers and schools, while 41% pointed to technology platforms and 30% to public authorities.

The findings come as the European Union considers its proposed Kids Act, which aims to strengthen platform accountability through measures including age limits, parental controls and restrictions on features considered addictive.

Galissaire argued that regulation alone would not address the risks. She favoured requiring platforms to be safe by design, alongside prevention and education, warning that age restrictions could create a false sense of security if parents stopped monitoring their children’s online activities.