Japanese securities firm's system breached for 'unauthorized stock trades'; data of 4,975 customers leaked

[Financial News] A cyberattack on a Japanese securities firm's online trading system led to stock trades being made without customers' knowledge and personal information being leaked. Japanese financial authorities have begun investigating the cause, viewing it as a serious case in which the brokerage's outsourced system itself—not customer accounts compromised through phishing, as in previous incidents—was taken over.
According to Kyodo News, the Tokyo Shimbun and other foreign media on the 21st, Iwai Cosmo Securities announced that a server operated by Trade Works, which it had contracted to run and maintain its online trading system, was targeted in an unauthorized-access attack, resulting in stock trades in customer accounts that the account holders had not intended.
The securities firm said it detected unauthorized access on the 14th and took emergency measures, including cutting off communications. In the meantime, however, trading orders were submitted for seven accounts, and actual trades were executed in five of them. The firm said it immediately notified affected customers and completed measures to restore their accounts to the state they were in before the trades, so no actual financial losses occurred.
The cyberattack also exposed personal information, including the names and email addresses of 4,975 customers. The securities firm initially reported that 4,611 people were affected, then revised the figure after further investigation. However, passwords required for stock trading and other services were not leaked, and investigators confirmed that the stolen personal information was not used in the unauthorized trades.
Regarding the method of the attack, Trade Works, the system operator, explained, "Security measures such as multi-factor authentication were in place during ordinary customer logins, but there were shortcomings in the settings for some of the system's administrative functions, which a third party exploited." In other words, this was a 'system takeover' that exploited a security vulnerability in the trading system itself, rather than an information leak caused by customer negligence.
There was also an awkward episode in the process. Iwai Cosmo Securities initially announced that the attacker had used artificial intelligence (AI) to target system vulnerabilities and carry out indiscriminate attacks. But after Trade Works disagreed, saying, "We cannot determine whether AI was used," the firm quietly removed the reference to AI from its official announcement.
The Japanese government and financial authorities are also responding swiftly to this unprecedented incident. Cabinet Secretary Minoru Kihara said at a press conference on the 21st, "The Financial Services Agency has asked the securities firm to analyze the cause of the incident and draw up measures to prevent a recurrence." Japan Securities Dealers Association Chairman Takashi Hibino also said he took the incident seriously, stressing that the association would work with the Financial Services Agency to actively support security reviews of trading systems at small and midsize and regional securities firms, as well as the development of countermeasures.


[email protected] Park Ji-hyun Reporter