For: people who applied for or bought digital bonds or digital securities (security tokens), especially anyone whose bank account number may be included. This article is an explanation based on the companies' official notices; it does not cover attack methods.
Developing: this article will be updated as the organisations publish more
- Who is affected
people who applied for or bought digital bonds or digital securities (security tokens), especially anyone whose bank account number may be included.
- Confirmed so farSee the table ↓
- Marui Group (issuer)
- Sony Bank (distributor)
- NTT Data (platform provider)
1 more
- Phillip Securities Japan (distributor)
Listed as possibly affected
- Rakuten Securities (distributor)
- Kagome (issuer)
- Kintetsu Group Holdings (issuer)
2 more
- West Japan Railway (issuer)
- Starts Securities (distributor)
- Not yet confirmed
- Details of the cause (route and scope)
- Final list of affected people and counts across issuers and distributors
- Whether other issuers or distributors will announce
2 more
- Whether the data has been misused
- When trading and services will resume
- What to do nowSee the steps ↓
- Do not respond to contact in these companies' names
- Check individual notices by opening them yourself
- If your bank account number may be included, check your account activity
3 more
- Protect your securities login (if you have a Rakuten Securities account)
- Know that some trading is suspended
- If you entered information or sent money, get help right away
- Where to verify (source)All sources ↓
- Marui Group, "Information leak of customers due to unauthorized access to an outside contractor managing digital bonds" (November 2, 2026)
- Last checked
- As of November 14, 2026
Follow-up plans and what we checked
This site confirmed official notices from 10 companies. Other companies are reported to have announced too, but we could not confirm their notices, so they are not in the table. The companies say no secondary harm (such as unauthorized trades) has been confirmed, or we found no record of any. When we checked the notices on November 14, the latest update was November 4 (Sony Bank).
What affected people should do today
Do not respond to contact in these companies' names
The data that may have leaked is names and contact details. Marui Group says the data could be used for impersonation and suspicious emails and texts, and asks you not to open URLs in messages you do not recognize or enter personal information. Kagome, Kintetsu Group Holdings and West Japan Railway also ask you to be careful with suspicious emails, texts and calls in their names.
Check whether a contact is real by opening the official site or app yourself, not through a link in the message. How to tell is in What is phishing?
Check individual notices by opening them yourself
The companies say they will contact affected customers individually. Kagome says it will notify through the Important Notices shown after login at Rakuten Securities, the seller. West Japan Railway says Rakuten Securities will contact affected people by email or other means. Marui Group says it will contact affected customers in turn.
To check how you will be contacted, use the official phone numbers and emails in the contact table below.
If your bank account number may be included, check your account activity
Bank account numbers may be included for 54 people at Marui Group and 4 at Sony Bank. Neither notice says that account PINs or passwords leaked. But someone who knows your account number and name finds it easier to make a contact that looks like a transfer (this site's view). Check your statement in the bank app or passbook, and do not respond to any contact asking for PINs or one-time passwords.
If you get an unexpected deposit or a message saying "I transferred by mistake, please return it", do not send money yourself; talk to your bank first. Neither notice recommends changing your account. For general advice see the Japanese Bankers Association's warning and the National Police Agency's caution (both in Japanese; general advice, not about this incident).
Protect your securities login (if you have a Rakuten Securities account)
Rakuten Securities says login IDs and passwords are not among the information that may have leaked. It is making passkey login mandatory, which resists phishing, and recommends setting it up if you have not. See What is a passkey? and Choosing two-factor authentication.
Know that some trading is suspended
Sony Bank says trading of digital securities is currently suspended and it will tell customers after recovery. NTT Data has also suspended its digital securities platform "STdirectServices" and will decide on resuming after confirming safety measures. Be careful with messages that pretend to be notices about the suspension.
If you entered information or sent money, get help right away
If you entered account details or personal information on the page behind a suspicious message, or sent money, contact your bank or securities company right away. You can also call the police advice line (#9110) or the Consumer Hotline (188). For suspicious activity on an account see How to check for unauthorized access.
What happened (from the companies' notices)
Several issuers and distributors say the system of the same contractor was accessed without authorization. The notices of Marui Group, Sony Bank, NTT Data and others name the contractor as Securitize Japan. What follows is from their notices. The dates are each company's announcement date; they did not all come out at once.
Oct 29
A third party accessed the contractor's system. Starts Securities says the contractor detected it on October 29. Phillip Securities Japan says it was accessed in the early hours of that day and confirmed that morning. Marui Group and NTT Data say unauthorized access occurred (was received) on October 29.Oct 30
NTT Data reported to issuers and distributors (Kagome, Kintetsu Group Holdings, West Japan Railway). Sony Bank posted its notice dated October 30.Oct 31
NTT Data announced the suspension of "STdirectServices" (first report). Rakuten Securities, Starts Securities, Kagome, Kintetsu Group Holdings and West Japan Railway announced. Phillip Securities Japan also issued its first notice; in its November 2 follow-up it says part of that notice, on the scope of customer information confirmed to have leaked, was wrong and corrected it.Nov 2
Marui Group (up to 9,086 people), NTT Data (second report), Pan Pacific International Holdings (first report) and Phillip Securities Japan (follow-up, 162 people) announced. Sony Bank updated its notice on this day and on November 4 (the page does not describe what changed).Nov 14
This site checked each company's notice. We found nothing newer than the above.
- Occurrence
- October 29, 2026 (unauthorized access by a third party to the system of the contractor that provides management for digital bonds and digital securities)
- Who is affected
- People who applied for or bought digital bonds or digital securities. Counts differ by issuer and distributor
- Cause
- NTT Data, second report: a weakness in the authentication function of the contractor's SaaS was exploited, administrator privileges were obtained without authorization, and information was taken. The detailed route and scope are under investigation
- Response
- The contractor stopped the service, blocked the route and invalidated the improperly obtained administrator privileges (NTT Data). Sony Bank has suspended digital securities trading
- Secondary harm
- Marui Group, Sony Bank, Rakuten Securities and NTT Data say no misuse or unauthorized trades have been confirmed so far
What is known and what is not
This is the state on November 14, 2026 of the 10 companies whose official notices this site read. Companies count differently, and the same purchaser may appear at both an issuer and a distributor, so the counts cannot be added up.
| Company (role) | Announced | Affected | Information that may have leaked | Status |
|---|---|---|---|---|
| Marui Group (issuer) | Nov 2 | Up to 9,086 people (leak confirmed); 54 may include account numbers | Name, address, phone number, email address, date of birth, gender, bank account number, investment units | Leak confirmed (up to 9,086 people; account numbers possible for 54) (company) |
| Sony Bank (distributor) | Oct 30 (updated Nov 2 and 4) | 621 people | 4 people: name, address, date of birth, account number. 617 people: name | Confirmed (company) |
| NTT Data (platform provider) | Oct 31 (first report), Nov 2 (second report) | bond purchasers (111 and 2,678 in separate groups), plus system users (number under investigation) | Two issuers, 111 people: name, address, phone number, email address, gender, date of birth. One issuer, 2,678 people: name in kana, bond quantity purchased, email address. Staff users: name, email address | Confirmed (company) |
| Rakuten Securities (distributor) | Oct 31 | 362 cases in total (three bonds: Kagome, West Japan Railway, Kintetsu Group Holdings; no breakdown by bond) | Items under investigation. Login IDs and passwords and information needed for trading are not included | Possible (company) |
| Kagome (issuer) | Oct 31 | 109 of 5,472 purchasers | Name, address, phone number, email address, gender, date of birth | Possible (company) |
| Kintetsu Group Holdings (issuer) | Oct 31 | 2,678 cases among people who bought 1 million yen or more of the 135th unsecured bond | Name, purchase amount. It does not hold securities account numbers or passwords | Possible (company) |
| West Japan Railway (issuer) | Oct 31 | 2 cases | Name, address, phone number, email address, gender, date of birth | Possible (company) |
| Starts Securities (distributor) | Oct 31 | No count given | Name, holdings. Access to contact details such as address, phone number and email, and to authentication information, has not been confirmed | Possible (company) |
| Phillip Securities Japan (distributor) | Oct 31, Nov 2 (follow-up) | 162 purchasers of the film digital security | Name, trading quantity | Confirmed (company) |
| Pan Pacific International Holdings (issuer) | Nov 2 (first report) | Under investigation | Whether anything leaked, who is affected and what data are all under investigation | Not stated |
On the cause: NTT Data says a weakness in the authentication function of the contractor's SaaS was exploited (status: partly confirmed, per NTT Data). The detailed route is under investigation. We found no notice from the contractor itself on its official top page on November 14, 2026 (status: not stated).
Contacts (as listed in each notice)
| Company | Contact |
|---|---|
| Marui Group | Customer line 0120-659-757 (10:00 to 18:00 Japan time, closed Wednesdays and Sundays), email maruigroup-socialbond@0101.co.jp |
| Sony Bank | Unauthorized-use emergency line 0120-365-738 (9:00 to 17:00, including weekends and holidays). |
| Kagome | Finance and IR Dept. / Corporate Communications 03-5623-8503 (weekdays 9:00 to 17:00) |
| Kintetsu Group Holdings | General Policy Division 06-6775-3472 (weekdays 10:00 to 17:00) |
| West Japan Railway | Corporate Strategy Division 06-6375-8939 (weekdays 9:30 to 17:00) |
| Starts Securities | Securities Business Dept. 03-3686-2511 |
| Phillip Securities Japan | 0120-883-301 (weekdays 9:00 to 17:00) |
| Pan Pacific International Holdings | Email info-securitytoken@ppih-group.com |
| Rakuten Securities | No dedicated contact in the notice; use the inquiry page on its site |
| NTT Data | Public Relations (for media) email nttdata-pr-inquiries@am.nttdata.co.jp |
What is different when the breach is at a contractor
This time the system that was accessed was not that of the company the customer dealt with (issuer or distributor) but a contractor behind it. Marui Group says no leak from its own systems has been confirmed so far, and Phillip Securities Japan says it was not unauthorized access to its own systems or a leak of information it manages. The next table is what such combinations of items can generally lead to. It does not mean these things happened in this incident.
| Item that may have leaked | What can generally happen | What to do |
|---|---|---|
| Name + email address + phone number | Realistic emails, texts or calls in the name of the issuer or distributor | Do not open links; check on the official site or app |
| Name + date of birth + address | "Identity checks" used to get the rest of your data | Do not answer even if the caller states your date of birth |
| Bank account number + name | Contact that looks like a transfer, "I sent money by mistake" refund requests | Do not send money yourself; talk to your bank |
| Name + investment units / purchase amount | Pitches aimed at people with assets, or contact pretending to be about redemption or perks | Check redemption and perk notices on the issuer's official site |
What may have leaked
- Name, address, phone number, email address, date of birth, gender (varies by company)
- Investment units, purchase quantity, purchase amount (varies by company)
- Bank account number (54 people at Marui Group, 4 at Sony Bank)
Stated as not included, within the notices
- Credit card information (Marui Group; not entrusted to the contractor)
- Login IDs and passwords, and information needed for trading (Rakuten Securities)
- Securities account numbers, passwords and similar financial transaction data (Kintetsu Group Holdings; not held)
What issuers and distributors should review: administrator privileges at the contractor
The cause is still under investigation, so we write only what the published facts support.
- Check the contractor's administrator privileges. NTT Data says administrator privileges on the contractor's SaaS were obtained without authorization. In general, the customer data a contractor can see with administrator privileges, and how strongly those privileges are authenticated, are things the client can ask about.
- Entrust fewer items. Kintetsu Group Holdings does not hold securities account numbers or passwords, and Marui Group says it did not entrust credit card information to the contractor. Data that is not handed over cannot leak from there.
- Agree who announces what and when. This time the notices were spread from October 30 to November 4, and we found none from the contractor itself. Deciding before the contract who tells users what, and when, if the contractor stops, makes contact with users faster.
Sources (public record)
The facts in this article are based on the official notices below (all in Japanese). We have not speculated about details of the cause that have not been disclosed.
- Marui Group, "Information leak of customers due to unauthorized access to an outside contractor managing digital bonds" (November 2, 2026) — 0101maruigroup.co.jp
- Sony Bank, "Information leak due to unauthorized access to an outside contractor for digital securities" (October 30, 2026; updated November 2 and 4) — sonybank.jp
- NTT Data, "Suspension of STdirectServices (second report)" (November 2, 2026) — nttdata.com
- Rakuten Securities, "Possible leak of customer information due to unauthorized access to an outside service provider" (October 31, 2026) — rakuten-sec.co.jp
- Starts Securities, "Possible leak of personal information due to unauthorized access" (October 31, 2026) — starts-sc.com
- Phillip Securities Japan, "Customer information leak due to unauthorized access to an outside contractor (follow-up)" (November 2, 2026) — phillip.co.jp
- Kagome, "Possible leak of personal information of customers who bought our digital-perk bond, and our response" (October 31, 2026, PDF) — kagome.co.jp
- Kintetsu Group Holdings, "Possible leak of investor information due to unauthorized access to an outside service" (October 31, 2026, PDF) — Kintetsu Group Holdings notice (PDF)
- West Japan Railway, "Possible leak of investor information due to unauthorized access to an outside service" (October 31, 2026, PDF) — westjr.co.jp
- Pan Pacific International Holdings, "Apology and notice about unauthorized access to the management system of our digital bonds (first report)" (November 2, 2026, PDF) — ppih.co.jp
Update history
2026-11-14: First version. Based on notices from Marui Group (November 2), Sony Bank (October 30, updated November 2 and 4), NTT Data (November 2), Rakuten Securities, Starts Securities, Kagome, Kintetsu Group Holdings and West Japan Railway (October 31), Phillip Securities Japan (November 2) and Pan Pacific International Holdings (November 2). We checked the notices the same day and found nothing newer than November 4. Other companies are reported to have announced too, but only notices we could confirm are in the table.
Read next
- How to spot fake contact: What is phishing? / What is a passkey?
- Protecting your login: Choosing two-factor authentication
- Suspicious activity on an account: How to check for unauthorized access
- A similar contractor-route incident at a securities firm: Daiwa Securities contractor breach (about 110,000 people)
- Other incidents in 2026: Data breaches and cyberattacks (Japan and overseas)