For: likely mainly people who borrowed a card loan from a bank, credit union (shinkin bank) or internet bank with SMBC Consumer Finance as the guarantor (up to 320,118 people; the company does not define who is affected). This article is an explanation based on the official notice from SMBC Consumer Finance Co., Ltd.; it does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
likely mainly people who borrowed a card loan from a bank, credit union (shinkin bank) or internet bank with SMBC Consumer Finance as the guarantor (up to 320,118 people; the company does not define who is affected).
- Confirmed so farSee the table ↓
- Detection and cut-off
- Number of people
- Name, sex, date of birth, address
6 more
- Home and mobile phone numbers
- Email address
- Driver's license number
- Employer information (phone number, income and so on)
- Contract information (financial institution code, customer number, guaranteed amount, guarantee start date and so on)
- Data sent outside
- Not yet confirmed
- Cause (how the access happened)
- Final scope (from the maximum figure)
- When individual notices will be sent
1 more
- How long the guarantee system stays suspended, and when it restarts
- What to do nowSee the steps ↓
- Find out who guarantees your card loan
- Do not engage with calls, emails or texts claiming to be your lender or the company
- Verify an individual notice through the official line, not through its link
3 more
- Assume your driver's license number leaked, and check your credit report
- Prepare for suspicious calls to your workplace
- If you entered details or paid money, get help right away
- Where to verify (source)All sources ↓
- SMBC Consumer Finance Co., Ltd., notice on unauthorized access to its guarantee system and the leak of customer information (November 5, 2026, company website; Japanese)
- Last checked
- As of November 9, 2026
Follow-up plans and what we checked
The company says it is investigating the cause and scope with experts and related parties, and will work on preventing recurrence and strengthening its information management. When we checked the company's news list on November 9, 2026, the notice of November 6 about the added toll-free number was the latest and we found no follow-up.
What card loan customers should do today
Find out who guarantees your card loan
The leak came from the system of the company that acts as guarantor, not from the system of the bank that lent the money. The company guarantees card loans issued by regional banks, credit unions (shinkin banks), internet banks and other institutions.
The guarantor is often named in your contract documents or in the card loan terms on your lender's official website. If you cannot tell, ask your bank through its official contact point. Docomo SMTB Net Bank says on its own site that up to 122,635 of its card loan customers are affected.
Do not engage with calls, emails or texts claiming to be your lender or the company
The company warns that suspicious calls, emails and texts claiming to be from the company or financial institutions may be sent. If you get an unexpected message, it asks you not to open URLs or enter personal information, and to consult its dedicated line or the police.
With a license number or income added to name, address and phone number, a convincing message is easy to build. Getting those details right proves nothing. Hang up and call back using the contact point in the official notice or the number on your bank's official website.
Verify an individual notice through the official line, not through its link
The company says it will notify affected people individually by email, SMS and similar means, in consultation with its partner institutions, once it has pinned down the scope. No timing is given. Because fake messages imitating such a notice may arrive, do not use the links or phone numbers in the message; call the company's dedicated line (toll-free 0120-362-167) directly.
If the message asks for a password, PIN, verification code or an image of your license, it is very likely fake (for how to spot them, see What is phishing?).
Assume your driver's license number leaked, and check your credit report
Images of licenses are not included, but the number is. A number alone is unlikely to pass identity checks that require reading the card's IC chip or showing the original, yet it can be used to make a message or application look like it came from you.
You can request disclosure of your own credit information from the credit bureaus to check that no application or contract you do not recognise has been created. Whether registering a personal alert or reissuing your license helps is covered in What to do when your driver's license information leaks.
Prepare for suspicious calls to your workplace
The leaked information includes your employer's phone number and your income. In general, knowing your employer can lead to calls to the workplace in which someone claims to be a financial institution and tries to learn about your employment or income. This is not a statement that it happened in this incident.
Telling a colleague or the general affairs team not to give out personal information if someone claiming to be your lender calls is a simple safeguard. If you would rather not say that you have a loan, you can simply ask them to take a call-back number and pass it on to you.
If you entered details or paid money, get help right away
If you entered details on a page linked from a suspicious message or transferred money, contact your lender bank and card company immediately. In Japan you can also call the police consultation line (#9110) or the consumer hotline (188).
What happened (from the SMBC Consumer Finance notice)
The company published its notice on November 5, 2026, and on November 6 announced the added toll-free number for its dedicated line. Everything below is the company's own account.
Nov 2
The company detected the unauthorized access and, with preventing further damage as its top priority, cut off access to the system used for its guarantee business the same day.During the investigation alongside the Nov 2 cut-off (date not stated)
While checking for other unauthorized access, the company confirmed that the data sent out of the system included customers' personal information (the date of this finding is not stated).Nov 5
The company announced the incident. It has suspended the guarantee system and continues safety checks and necessary maintenance.Nov 6
The company added a toll-free number, 0120-362-167, to its dedicated customer line.
- What happened
- Unauthorized access by a third party to the system the company uses for its guarantee business. Data was sent out of the system and included customers' personal information
- Detection and cut-off
- Detected on November 2, 2026; access cut off the same day
- Number of people
- Up to 320,118
- Leaked information
- Name, sex, date of birth, address, home phone number, mobile phone number, email address, driver's license number, employer information (phone number, income and so on), contract information (financial institution code, customer number, guaranteed amount, guarantee start date and so on)
- Not included
- Images of identity documents such as driver's licenses
- Secondary harm
- None confirmed at present as caused by this incident
- Notice to affected people
- Individually by email, SMS and similar means after the scope is set, in consultation with partner institutions
- Contact
- Company customer line: toll-free 0120-362-167, phone 03-5677-9228 (9:00 to 18:00 Japan time, including weekends and holidays)
Partner banks are also posting notices
On November 5, 2026, Docomo SMTB Net Bank said on its own site that up to 122,635 of its card loan customers are affected. It says the unauthorized access was to the guarantor's system and that no unauthorized access to the bank's own systems has been confirmed. The company's notice does not give a breakdown of people by partner institution. We cover only notices of other institutions that we could confirm on their official pages, so none are included here.
What is known and what is not
This table is based on the company's notices of November 5 and 6, as of November 9, 2026. When follow-up notices appear, we will update the status column.
| Item | What the notice says | Status |
|---|---|---|
| Detection and cut-off | Detected on November 2 and access cut off the same day | Confirmed (company) |
| Number of people | Up to 320,118 | Confirmed (maximum figure the company published) |
| Name, sex, date of birth, address | Included in the leaked information | Leak confirmed (company) |
| Home and mobile phone numbers | Included in the leaked information | Leak confirmed (company) |
| Email address | Included in the leaked information | Leak confirmed (company) |
| Driver's license number | Included in the leaked information | Leak confirmed (company) |
| Employer information (phone number, income and so on) | Included. "And so on" is used; whether other items are included is not stated | Leak confirmed (company) |
| Contract information (financial institution code, customer number, guaranteed amount, guarantee start date and so on) | Included. "And so on" is used; whether other items are included is not stated | Leak confirmed (company) |
| Images of driver's licenses and other identity documents | Not included | Not included (company) |
| Passwords and PINs | Not in the list of leaked information | Not stated |
| Data sent outside | Data was sent from the guarantee system to the outside | Confirmed (company) |
| Cause and how the access happened | Under investigation. The route is not stated | Under investigation |
| Secondary harm | None confirmed at present | Not confirmed (company) |
| Individual notices to affected people | After the scope is set, by email, SMS and similar means with partner institutions. No timing | Under investigation |
| People who borrowed directly from the company | The notice refers to "the system used for the guarantee business" and does not say whether the company's own direct borrowers are included | Not stated |
| Guarantee system operation | Suspended; safety checks and maintenance continue. No restart date | Under investigation |
What a license number, employer details and income can be used for
When a license number, employer, income and guaranteed amount are added to an address and phone number, messages can be built from details that only you were supposed to know. The following are things that can happen in general, not a statement that they happened in this incident.
Name + phone number + guaranteed amount / start date
↓→
Calls or texts that claim to be your lender and quote your loan details
→ Hang up and call back via the official notice or your bank's site
License number + date of birth + address
↓→
Applications made to look like yours; "identity checks" that fish for the rest of your data
→ Do not confirm the number. Check your credit report
Employer phone number + income
↓→
Calls to your workplace posing as a financial institution; pitches for "refinancing" or "repayment" that assume your income
→ Tell your workplace. Do not trust a caller who quotes your income
What the leaked data can enable
- Calls and texts that claim to be your lender or the company and quote your loan amount and guarantee start date
- Emails or texts imitating the individual notice that lead to a fake page
- Calls to your workplace claiming to be a financial institution
What the leaked data alone makes difficult (this site's assessment)
- Passing an identity check that relies on license images (the company says images are not included)
- Faking the official contact point when you dial it yourself (the numbers are in the official notice)
- Logging in to the bank's systems (passwords are not in the notice's list, and Docomo SMTB Net Bank says it has confirmed no unauthorized access to its own systems)
What lenders and guarantee partners should review: what you hand to the guarantor
The details of the cause have not been disclosed, so this section only covers what follows from the published facts.
- Limit what the guarantor receives to what screening and administration need. The guarantor's system held license numbers, employer phone numbers and income. How much of that screening needs has not been disclosed. In general, deciding in the partner agreement whether to keep number-type data and income after screening is finished makes less leak when an incident happens.
- Agree with partners in advance what happens when an incident occurs. The company detected the access on November 2 and announced on November 5, three days later. Docomo SMTB Net Bank says it received the company's report on November 5. Setting for each partner the reporting deadline, the text of the notice to customers and the contact point beforehand shortens the time to notify customers.
Sources (public record)
The facts in this article are based on the public information below. We have not speculated about details of the cause that have not been disclosed.
- SMBC Consumer Finance Co., Ltd., notice on unauthorized access to its guarantee system and the leak of customer information (November 5, 2026, company website; Japanese) — smbc-cf.com
- SMBC Consumer Finance Co., Ltd., notice of the added toll-free number for the dedicated customer line (November 6, 2026, company website; Japanese) — smbc-cf.com
- Docomo SMTB Net Bank Co., Ltd., notice on the leak of its card loan customers' information through unauthorized access to a guarantee partner (November 5, 2026, bank website; Japanese) — netbk.co.jp
Update history
2026-11-09: First version, based on SMBC Consumer Finance Co., Ltd.'s notice of November 5 and its notice of November 6 about the added toll-free number. We checked the company's news list the same day and found no follow-up notice.
Read next
- When a license number leaks: What to do when your driver's license information leaks
- A same-period incident involving identity document numbers: Unauthorized access to Docomo Online Shop and My docomo
- Spotting fake messages: What is phishing? / Smartphone security basics
- Other 2026 incidents: list of breaches and cyberattacks (Japan and worldwide)