Who this is for: people who have applied for an account with Monex Securities online (especially since October 16, 2019), and people who submitted images of ID documents. This article is an explainer based on Monex Securities' official announcement. It does not cover attack methods.
続報待ち：この記事は公式発表に合わせて更新します
- Who is affected
people who have applied for an account with Monex Securities online (especially since October 16, 2019), and people who submitted images of ID documents.
- Confirmed so farSee the table ↓
- Attempt detected, access cut off
Listed as possibly affected
- Email addresses
- ID document images
- Not yet confirmed
- Cause (route of the unauthorized access)
- Identifying affected data record by record, and the confirmed number of leaked items
- Timing and method of individual notices to affected people
2 more
- When account opening will resume
- Whether any misuse has occurred
- What to do nowSee the steps ↓
- Do not open links in email or SMS claiming to be from Monex Securities
- If images of your ID documents may be affected, prepare for impersonated applications
- Check your brokerage account's login history and transaction history
2 more
- If you are worried, contact the official line
- If you entered details or sent money, get help right away
- Where to verify (source)All sources ↓
- Monex Securities, "Apology and notice regarding the leak of personal information due to unauthorized access to part of the account-opening systems run and managed by an outsourced contractor" (November 13, 2026, in Japanese, linked from the notices on the company's official site)
- Last checked
- As of November 15, 2026
Follow-up plans and what we checked
The figures are what the investigation has confirmed so far; the investigation continues and they may change after further review. The company says it has cut the affected system off from the network and has not confirmed any new unauthorized access so far. It will continue the investigation with an external specialist firm and the outsourced contractor, and says it will announce new findings promptly. As of November 15, 2026, we found no follow-up after the November 13 announcement in the company's official notices.
What to do today
Do not open links in email or SMS claiming to be from Monex Securities
The information that may have leaked includes email addresses. The company says it has not confirmed phishing or other harm related to this incident so far, and asks you not to open URLs in suspicious email or SMS claiming to be from Monex Securities or a financial institution, not to enter passwords or other details, and not to reply.
The company says it never prompts you to log in by email or SMS, and never asks for login or trading passwords by email, SMS, phone or similar means. Do not respond to messages like "security check" or "please log in again", even if they look genuine. Log in through the official app or a bookmark you saved yourself. See What is phishing? for how to tell them apart.
If images of your ID documents may be affected, prepare for impersonated applications
The images named are the front of My Number cards, the front and back of driver's licenses, and selfie images. The company says no leak of the My Number or the back of the card has been confirmed. As far as has been disclosed, no misuse has been confirmed.
In general, images of ID documents that show your name, address and date of birth can be used to impersonate you when applying to other financial or online services (this site's view). For a while, watch for notices about account openings you did not make, credit card or loan screening contact, and bills from companies you do not know. For the types of misuse and how to stop them, see What to do when a driver's license or ID document leaks. The company's announcement does not include an official recommendation to reissue My Number cards or driver's licenses.
Check your brokerage account's login history and transaction history
The company says no unauthorized trading or impact on assets has been confirmed so far. Even so, while your email address or ID images may be known to others, it is reassuring to look at your account activity yourself. Check the Monex Securities login history, trade reports, and deposit and withdrawal history. Use the screens and methods the company describes on its official site.
If you see a login, trade or change to your registered details that you do not recognize, contact the official line right away. If you use the same email address and password combination on other services, review that reuse (How to check if your password has leaked). In the company's announcement, passwords are not included.
If you are worried, contact the official line
The contacts in the announcement are toll-free 0120-846-365 (weekdays 8:00-17:00), and 03-6737-1666 from mobile phones and PHS (call charges apply). When the line is busy or outside hours, you can use the inquiry form under "Customer Support" on the official site. On November 13, 2026 only, hours were extended to 19:00.
Use the contacts listed on the official site, not numbers written in an email or SMS.
If you entered details or sent money, get help right away
If you entered an ID or password on the page behind a suspicious message, contact the official line immediately and change the password on any other service where you use the same one. If you sent money, consult your bank and the police consultation line (#9110) or the Consumer Hotline (188). For suspicious activity on an account, see How to check for unauthorized access.
What happened (from Monex Securities' announcement)
On November 13, 2026, Monex Securities published "Apology and notice regarding the leak of personal information due to unauthorized access to part of the account-opening systems run and managed by an outsourced contractor" (in Japanese). Everything below is from the company's announcement. This article refers to the contractor by role rather than by name.
Oct 18 (Sun)
The outsourced contractor that runs and manages part of the company's account-opening systems detected an attempted unauthorized access to the system by a third party.Oct 19 (Mon)
External access was cut off.Nov 13
Account opening is currently partly suspended (no start date is given). The company published the notice, saying an interim report from an external forensic firm found that part of the personal information may have leaked.
- Timeline
- On Oct 18 the outsourced contractor detected an attempted unauthorized access; on Oct 19 external access was cut off. Account opening is currently partly suspended (no start date is given)
- Information 1
- Email addresses, up to 1.13 million. Registered in the first step of online account-opening applications since Oct 16, 2019. Includes duplicate or incomplete entries and addresses of people who did not complete account opening
- Information 2
- ID document image files, 1,592. Data of people who applied by the method that requires taking photos, including the front of My Number cards, the front and back of driver's licenses, and selfie images
- Not included
- Account numbers, login passwords, trading passwords and similar (not in the same database; confirmed not leaked as of now). No leak of the My Number or the back of the card confirmed. No leak has been confirmed for people who used the My Number card authentication (public personal authentication) method
- Impact
- No unauthorized trading or impact on assets confirmed so far. The affected system is separate from the core system; login and normal trading are not affected
- Cause
- Under investigation
- Contact
- 0120-846-365 (weekdays 8:00-17:00), 03-6737-1666. Outside hours, the form on the official site
What is known and what is not
This is based on the company's announcement (November 13) as of November 15, 2026. We will update the Status column when there is news.
| Item | What the announcement says | Status |
|---|---|---|
| Attempt detected, access cut off | Detected Oct 18; external access cut off Oct 19 | Confirmed (company) |
| Email addresses | Up to 1.13 million. Registered in the first step of online account-opening applications since Oct 16, 2019 | Possible (company; upper-bound figure) |
| ID document images | 1,592. Front of My Number cards, front and back of driver's licenses, selfie images | Possible (company; figure as of now) |
| Identifying affected data record by record | Not yet identified individually; investigation continues | Not stated (under investigation) |
| Account numbers | Not in the same database; confirmed not leaked as of now | Not included (company, as of now) |
| Login and trading passwords | Not in the same database; confirmed not leaked as of now | Not included (company, as of now) |
| My Number and back of the card | No leak confirmed | Not confirmed (company) |
| Information of applicants using public personal authentication | No leak confirmed | Not confirmed (company) |
| Unauthorized trading, impact on assets | Not confirmed so far | Not confirmed (company) |
| Phishing or other harm | No harm related to this incident confirmed so far | Not confirmed (company) |
| Cause and detailed course | Under investigation | Not stated |
| New unauthorized access | System cut off; none confirmed so far | Not confirmed (company) |
| Notice to affected people | Individual notices, in sequence, as required by applicable law, once a leak is confirmed | Planned (company) |
| Resumption of account opening | Some account opening is currently suspended (no start date given); timing to be announced on the official site | Not stated (timing undecided) |
What can happen with each item
The table below shows what can generally happen with items like these. It does not mean these things have happened in this incident.
| Item that may have leaked | What can generally happen | Action |
|---|---|---|
| Email addresses (up to 1.13M) | Phishing email posing as a brokerage, redirection to a fake login page | Do not open links; check via the official app or a bookmark |
| ID document images (1,592) | Impersonated applications to other services | Watch for application or screening contact you did not initiate; contact the official line if worried |
| Selfie images | Concern about misuse in photo-based identity checks | Wait for the company's notice and ignore suspicious contact |
What can happen with the information that may have leaked
- Genuine-looking email and SMS posing as Monex Securities or a financial institution
- Impersonated applications using ID document images
- Fake messages that pretend to be the individual notice
What the announcement says has not leaked or is unconfirmed (as of now)
- Account numbers, login passwords, trading passwords (confirmed not leaked as of now)
- My Number and the back of the card (no leak confirmed)
- Login and normal trading on existing accounts (no impact)
- Information of people who applied with public personal authentication (no leak confirmed)
For operators: managing an outsourced account-opening system
The cause has not been disclosed, so this section only covers what can be said from the disclosed facts.
- Do not keep ID document images for long (a general point): the company has not disclosed how long it kept images. In this incident, data from people who only registered an email address partway through an application is included. In general, setting a retention period and scope for in-progress application data and for ID images whose checks are finished, and deleting what is past its limit, reduces how much one breach can expose.
- Judge the contractor's environment by your own standard: the company says the affected system is separate from the core system and that core information did not leak. When you entrust personal data to a contractor, fixing in the contract and in audits which items are stored, how access is logged and the deadline for reporting a breach can shorten the time from cut-off to announcement.
Sources (public record)
The facts in this article are based on the official announcement below. We have not speculated about details of the cause that have not been disclosed.
- Monex Securities, "Apology and notice regarding the leak of personal information due to unauthorized access to part of the account-opening systems run and managed by an outsourced contractor" (November 13, 2026, in Japanese, linked from the notices on the company's official site) — info.monex.co.jp
- The company's press release with the same title, as posted on PR TIMES (in Japanese) — prtimes.jp
Update history
2026-11-15: First version. Based on Monex Securities' announcement of November 13. We checked the company's official notices the same day and found no follow-up.
Read next
- Another brokerage incident this month (closely related): Unauthorized access to Daiwa Securities' contractor (about 110,000 customers)
- When ID documents leak: What to do when a driver's license or ID document leaks
- How to spot fake contact: What is phishing? / Smartphone security basics
- Suspicious activity on an account: How to check for unauthorized access
- Other incidents in 2026: Data breaches and cyberattacks (Japan and overseas)