Daiwa Securities vendor breach (about 110,000 customers, 220,000 records): what may have leaked and what customers should do

According to the company's website, affected customers were contacted individually on October 5 through the message box (お知らせBOX) in online trading. Sign in yourself from a bookmark or the official app, not from a link in an email, and check there.

If you are unsure, call the dedicated line (0120-851850, 9 a.m. to 5 p.m. Japan time, closed weekends and holidays). Use the number published on the company's official site, not one given in a message you received.

What may have leaked is your name, email address, account number and the content of your inquiries. Together, these make it possible to write a fake message with the right name, the right account number, and a reference to your past inquiry.

The company's phishing page tells customers not to log in to online trading from emails. Even if a message talks about a security check, an apology or compensation, do not open the link; sign in from your usual bookmark or the official app (how to spot fakes: What is phishing?).

The company asks customers not to give their trading ID, password, PIN or one-time passwords in response to suspicious messages. The same applies if a caller says it is "to confirm your identity".

A caller who knows your name and account number has not proved anything. That is exactly the information that may have leaked.

The company offers passkey sign-in to online trading, using a fingerprint or face recognition. A passkey only works on the real site, so it helps prevent the damage that follows from typing your ID and password into a fake site (how it works: What is a passkey?; compared with other methods: Choosing MFA the right way).

Also confirm that operation notifications are on. These emails arrive when someone signs in, trades, withdraws money or changes personal details. The company says it switched them on for, in principle, all customers from May 11, 2025.

After signing in to online trading, open the "お手続き・サポート" (procedures and support) menu and choose "操作履歴" (operation history) to see recent sign-ins and procedures.

If you see a sign-in, trade or change you did not make, change your password at once and contact the company. If you use the same password elsewhere, separate it there too (how to check: How to check if your password has leaked).

In the message field of an inquiry form, customers often type account numbers, dates of birth, and sometimes even passwords. If identity checks are needed, have customers send inquiries from a signed-in screen, and do not store the numbers in inquiry records.

A first step is to detect strings shaped like account or phone numbers when a form is submitted and mask part of them before saving. Some inquiry-management services offer redaction of sensitive data or a way to process content before it is stored.

Once an inquiry is closed, its record is rarely used, but in a leak every record is exposed. Decide how long to keep old records and make them delete automatically when the period ends.

If a vendor stores them, set the retention period and deletion method in the contract and check at least once a year that deletion actually happens. A case where data was not deleted after a contract ended is in the ApplyNow entry of the 2026 incident list.

List every outside service that holds customer or applicant data: inquiry management, email delivery, surveys, recruiting and so on. For each, write down how many records and which items it holds, and within how many hours it must tell you if it detects unauthorized access.

Starting with the vendors that hold the most records, check that their admin screens have multi-factor authentication, source restrictions and alerts on large exports (background: Authentication vs authorization).