Security Guides
Iwai Cosmo Securities vendor breach (4,975 customers): what leaked, the unintended trades, and what customers should do
A vendor that runs and maintains Iwai Cosmo Securities' online trading system was accessed without authorization, leaking names, email addresses and more for 4,975 customers. On the same day, unintended orders were placed in 7 accounts. What is known, and what to do today.
For: people who use Iwai Cosmo Securities' online trading, and financial firms and businesses that outsource the operation of their trading systems. This article is based on the official notices from Iwai Cosmo Securities Co., Ltd. and Iwai Cosmo Holdings, Inc., and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 23, 2026Not yet known
- The specific method of the unauthorized access and of the attack on the trade management system
- What the 'other details' in the leaked data are
- Amounts and securities involved in the unintended orders
The second notice of October 20 raised the number of people to 4,975 and disclosed the unintended orders in 7 accounts. The company says it will promptly announce any newly found facts. As of October 23 we found no third notice. The company's website (www.iwaicosmo.co.jp) was showing an emergency maintenance page on October 23, so we checked the second notice through a saved copy in the Internet Archive (Wayback Machine).
What Iwai Cosmo Securities customers should do today
We keep what the company asks of customers separate from this site's general advice. Each step title says which one it is.
Do not use links or numbers in calls or emails claiming to be the company (company warning)
The company warns that calls and emails pretending to be from it may occur. Because names and email addresses leaked, expect fake messages with your correct name, sent by someone who knows you are a customer.
Even if a message talks about confirming fraudulent trades, compensation or a security check, do not open its links, and do not call any phone number given in the message (how to spot fakes: What is phishing?).
Sign in from your bookmarked login page and check your notices (company's individual contact)
The company says it had individually informed the 4,611 people from the first notice by October 16, and contacted the 364 people added in the second notice through the notice screen after logging in and by email. Sign in from a bookmark you saved yourself or your usual entry point, not from an email link, and check there.
On October 23 the company's website showed an emergency maintenance page, which asks customers to save the online trading login pages directly as favorites. According to the company's online trading site, this maintenance is to address the PHP vulnerability announced on October 21 and is not caused by unauthorized access or a cyberattack (about the PHP vulnerability: PHP critical vulnerabilities explained).
Look at your order and execution history (this site's advice)
The company says it contacted the customers of the 7 accounts with unintended orders individually on October 14, and says it has since restored their accounts to their state before the trades. Even if you were not contacted, it is worth checking your recent order and execution history, and whether your registered details have changed without your knowledge.
If you find an order or change you did not make, contact the Customer Consultation Office, as the company asks.
Never give anyone your password or trading PIN (this site's advice)
The company says the leaked data does not include trading PINs and cannot be used to log in or trade. That means the next thing a fake message will try to get from you is your login password and trading PIN.
Do not give them out, even to a caller who says it is "to confirm your identity". If you use the same password for other services, make them different (how to check: How to check whether your password has leaked; extra protection: Choosing MFA the right way).
Use the contact point in the official notice (company guidance)
The contact point in the notices is Iwai Cosmo Securities' Customer Consultation Office, phone 0120-405-546 (weekdays 9 a.m. to 5 p.m. Japan time). The company asks customers to contact it with any questions or concerns.
Use the number from the official notices listed in this article's sources, not one given in an email or text message you received.
What happened (from Iwai Cosmo Securities' notices)
The following is based on the company's notice of October 16, 2026 (a timely disclosure by Iwai Cosmo Holdings) and its second notice of October 20. The vendor is the business the company describes as the one it entrusts with "operating and maintaining our online trading system".
October 14, 2026
The company detected unauthorized access by a third party, immediately contacted the vendor and took emergency measures such as access restrictions. The same day, the trade management system was also attacked, and orders the customers did not intend were placed in 7 accounts (5 executed). The company contacted those customers individually that day.October 16
First notice published (the parent company's timely disclosure). It gave the leak as names, email addresses and other details of 4,611 people, said those people had been informed individually, and opened a contact point.October 20
Second notice published. A re-examination of access and communication logs added 364 people, for a total of 4,975. The unintended orders were also disclosed that day.As of October 23
The company's website shows an emergency maintenance page. The company's online trading site says this is to address a PHP vulnerability and is not caused by unauthorized access or a cyberattack (checked on October 23).
- Where from
- The system of the vendor the company uses to operate and maintain its online trading system
- Who
- Online trading customers, 4,975 people (the 4,611 from the first notice plus 364 found by re-examination)
- Items
- Names, email addresses and other details. The company says the data for the 364 people is within the scope of the first notice
- Not included
- Trading PINs. The company says the data cannot be used to log in to accounts or to trade
- The added 364
- Found by re-examination of the October 14 access; the company says no new unauthorized access or leak occurred afterwards
- Unintended orders
- On October 14 the trade management system was attacked, and unintended orders were placed in 7 accounts (5 executed). The accounts were restored and customers bear no cost, the company says
- Link to the leak
- The company says the leaked personal data was not used for these trades
- Timing of disclosure
- The company explains that on October 16 it was still rolling out measures to prevent similar damage, so it held back information that could point to the method
- Cause and measures
- The point that allowed the access has been identified and fixed, the company says. It says it confirmed the vendor added stronger security for management functions (access restrictions), stronger blocking of unauthorized traffic plus immediate detection of login anomalies, and stronger monitoring
- Other financial firms
- According to the vendor, systems it provides to other financial institutions were also checked, and no similar unauthorized access was found
- Contact
- Customer Consultation Office 0120-405-546 (weekdays 9 a.m. to 5 p.m. Japan time)
What is known and what is not
Status as of October 23, 2026. When the company publishes more, we will update the status column.
| Item | What the notices say | Status |
|---|---|---|
| Number of people | 4,975 (4,611 in the first notice + 364 on re-examination) | Leak confirmed (company) |
| Items leaked | Names, email addresses and other details | Leak confirmed (company) |
| What "other details" means | Not disclosed | Not stated |
| Trading PINs | Not in the leaked data | Not included (company) |
| Login passwords | No separate statement (the company says the data cannot be used to log in or trade) | Not stated |
| Unintended orders | Placed in 7 accounts, 5 executed; restoring the accounts to their state before the trades has been completed (second notice, October 20) | Confirmed (company) |
| Cost to customers | None | Confirmed (company) |
| Link between the trades and the leak | Leaked personal data was not used | Confirmed (company) |
| Amounts and securities of the orders | Not disclosed | Not stated |
| What allowed the access | Identified and fixed; specific method not disclosed | Not stated |
| Other financial firms | The vendor's check found no similar unauthorized access | Not found (vendor) |
| Secondary damage | First notice of October 16: none found | Not found (company) |
Unauthorized access to the vendor's system
↓→
Names, email addresses and more leaked (4,975 people)
→ Do not use the links or numbers in calls or emails
Attack on the trade management system (same day, October 14)
↓→
Unintended orders in 7 accounts (5 executed)
→ Restored to the state before the trades (company); check your order and execution history anyway
The company says the leaked personal data was not used for the unintended orders
The company says the unintended orders came from an attack on the trade management system, and that the leaked personal data was not used. In other words, its explanation is that the orders were not placed because names and email addresses leaked.
Even so, the leaked names and email addresses may be used for fake messages from now on. Stay careful with messages even though the orders have been dealt with.
What the leaked combination of items can be used for
In general, the following combinations allow the following kinds of misuse. This does not mean they have happened in this case.
- Name + email address: fake emails with your correct name. The sender also knows you are an Iwai Cosmo customer, so subject lines tied to the incident or to compensation become more likely
- The fact that the incident was reported: calls and emails framed close to the real notices, such as "confirming the unauthorized order" or "refund procedures", become easier to write
- Login ID, password and trading PIN typed into a fake site: with all of these, someone could enter your account and trade. These were not what leaked here, but they are what fake messages aim for
Japan's Financial Services Agency has issued a general warning about fraudulent trades using login details stolen through fake sites posing as securities firms (FSA warning, in Japanese). It is a general warning about securities accounts, not about this incident.
In a past case, the Daiwa Securities vendor breach, the vendor's own notice later showed that other companies on the same server were affected. In this case, the vendor says it checked the systems it provides to other financial institutions and found no similar unauthorized access.
For financial firms that outsource the operation of their trading systems
The specific method has not been disclosed, so we do not go into how to prevent the intrusion. What the published account does show is that the company says the unintended orders came from an attack on the trade management system and that the leaked personal data was not used. "Stronger security for management functions (access restrictions)" is listed first among the vendor's added measures. The points below are general checks prompted by what was published, not a statement of what caused this case.
List the management functions in your vendor's system, and who can use them from where
In general, a trading system has management functions used by operations and maintenance staff, separate from the customer screens. Adding multi-factor authentication to customer logins does not by itself protect the management side, which needs its own check.
As a first step, ask the vendor for a list of management functions, the accounts that can use them, and the restrictions on where they can be reached from (such as IP addresses), and confirm whether any management function can be reached directly from the internet.
Detect orders that did not come from a customer's own session, as they happen
The company detected the unauthorized access on the same day and contacted the affected customers that day. In general, an immediate alert when an order is placed without a customer login, or through an unusual route, time or volume, makes cancelling and contacting customers faster.
The vendor's added measures also include immediate detection of login anomalies and stronger monitoring (scheduled checks and immediate response to anomalies). On your side, decide who receives such alerts and who decides what to do within how many minutes.
Get the vendor's check results for your own environment
A single business may operate and maintain trading systems for several financial firms. Here, the vendor says it also checked the systems it provides to other financial institutions.
If you use the same vendor, get the result and scope of the check for your environment in writing (which period of logs was reviewed, and against what criteria). For the access-control side, see Authentication vs. authorization.
Sources (public record)
The facts in this article are based on the public information below. We do not speculate about undisclosed methods or causes.
- Iwai Cosmo Holdings, Inc., "岩井コスモ証券 外部委託先への不正アクセスに伴うお客様情報の漏洩について" (October 16, 2026, timely disclosure; the attachment is Iwai Cosmo Securities' notice) — iwaicosmo-hd.jp (PDF, Japanese)
- Iwai Cosmo Holdings press release, "外部委託先への不正アクセスに伴うお客様情報の漏洩について" (October 16, 2026) — iwaicosmo-hd.jp
- Iwai Cosmo Securities Co., Ltd., "外部委託先への不正アクセスに伴うお客様情報の漏洩について(第2報)" (second notice, October 20, 2026) — iwaicosmo.co.jp (not shown on October 23 because the website was under maintenance; checked through the Internet Archive copy saved on October 21)
- Iwai Cosmo Securities online trading site, maintenance notice (checked on October 23, 2026) — iwaicosmo.net
- Financial Services Agency, "インターネット取引サービスへの不正アクセス・不正取引にご注意ください" — fsa.go.jp
Update history
2026-10-23: First version, based on Iwai Cosmo Securities' notice of October 16 (the parent company's timely disclosure) and its second notice of October 20. The second notice was checked through the Internet Archive copy because the company's website was under maintenance. We will update this article when new facts are published.
Read next
- Protecting yourself from follow-up scams: What is phishing? / What is a passkey?
- Securing your login: Choosing MFA the right way / How to check whether your password has leaked
- Another securities firm this month: Daiwa Securities vendor breach (about 110,000 customers)
- Other 2026 incidents: Data breaches and cyberattacks of 2026
FAQ
QWhat was leaked in the Iwai Cosmo Securities breach?
According to Iwai Cosmo Securities' second notice of October 20, 2026, names, email addresses and other details (氏名、メールアドレス他) of 4,975 online trading customers leaked. The first notice of October 16 gave 4,611 people; a later re-examination added 364. What the 'other details' are has not been disclosed. The data leaked from the system of the vendor the company uses to operate and maintain its online trading system.
QHow do I know whether I am affected?
The company says it had individually informed the 4,611 people from the first notice by October 16, and contacted the 364 people added in the second notice individually through the notice screen after logging in to online trading and by email. Sign in from a login page you bookmarked, not from a link in an email, and check the notices there. If you are unsure, call the Customer Consultation Office (0120-405-546, weekdays 9 a.m. to 5 p.m. Japan time).
QWere trading PINs or passwords leaked?
The company says the leaked data does not include trading PINs and cannot be used to log in to securities accounts or to trade. It makes no separate statement about login passwords. Whatever message you receive, never give out your password or trading PIN.
QWhat were the unintended orders, and was money lost?
According to the second notice, on October 14, the day of the unauthorized access, the trade management system was also attacked, and orders the customers did not intend were placed in 7 accounts; 5 of them were executed. The company contacted those customers individually on October 14, has already restored the accounts to their state before the trades, and says customers bear no cost. It says the leaked personal data was not used for these trades. Amounts and securities involved have not been disclosed.
QWhat caused the breach?
The company says the vendor's system was accessed by a third party, and that the point that allowed the access has been identified and fixed. As additional measures, it says the vendor strengthened the security of management functions (access restrictions), strengthened blocking of unauthorized traffic and added immediate detection of login anomalies, and strengthened monitoring. As of October 23, the specific method had not been disclosed.
QWhat should I do if I get a call or email claiming to be from Iwai Cosmo Securities?
The company warns that calls and emails pretending to be from it may occur, and asks customers to contact its Customer Consultation Office about any unfamiliar message or trade. Do not use the numbers or links in the message you received; call back on the number in the official notice (0120-405-546, weekdays 9 a.m. to 5 p.m. Japan time). A message with your correct name and email address is not proof that it is genuine.