Osaka-based brokerage IwaiCosmo Securities Co. announced on Oct. 20 that a cyberattack on its online trading system allowed unauthorized trades in customer accounts and the personal data leakage of nearly 5,000 people.
The company and Tokyo-based Trade Works Co., which operates and maintains the system, disclosed the incident.
Unauthorized orders were placed in seven customer accounts, with trades executed in five, IwaiCosmo said.
An investigation also found that personal information on 4,975 people, including names and email addresses, had been exposed.
Cybersecurity expert Masakatsu Morii, professor emeritus at Kobe University, said the incident appeared to be unlike typical data breaches.
“I have never heard of a case like this in Japan. It is an attack on a completely different level from the leakage of personal information,” Morii said.
“If attackers were able to penetrate a brokerage firm’s trading system, which is at the core of its operations, and carry out unauthorized transactions, that would represent a fundamentally different type of attack from those seen previously and is extremely concerning,” he said.
The company said it had contacted affected customers and restored the accounts to their pre-trade status, leaving them with no losses.
Trade Works said it detected the attack on Oct. 14 and immediately imposed access restrictions.
The company said the trades were unrelated to the leaked data and that no online trading passwords or other credentials appeared to have been compromised.
Morii said he was not aware of previous cases in Japan in which attackers infiltrated a financial institution’s system and manipulated transactions.
“This time it involved a securities company, but it is the kind of incident that raises concerns that attackers could, in some cases, breach a bank’s system and move funds under their control. It is difficult to say the possibility is zero,” he said.
The system remains in operation after security measures were strengthened to block unauthorized communications.
“While continuing monitoring and inspections, we are working to determine the cause and prevent a recurrence,” said a corporate planning official.
Trade Works, which also provides online trading services for other financial institutions, said no similar incidents had been detected among its other clients as of Oct. 20.
(This article was compiled from reports by Rui Hosomi, Ryo Sanada and Ken Sakakibara.)