Unauthorized access to SMBC Nikko Securities' employee stock plan system (up to 56,487 members): names, addresses and transfer account information may have leaked — what plan members should do

The company asks plan members to be careful of suspicious contact that uses its name. Be equally careful with contact in the plan's name (this site's view). Even if a call, email, text or letter says "this is needed for your plan" or "for identity checks" and asks for account details or PINs, do not comply.

Phone numbers and email addresses did not leak, but that does not mean fake contact will not come. Names and addresses may be included, and contact details can be obtained by other means (this site's view). For how to spot fakes, see What is phishing?.

The company has not named the plans. It says it will contact individually the plans where a leak, or the possibility of one, was confirmed. The notice does not say how individual members will be told.

Check the guidance from your plan's administration office (often an HR or general affairs department). If nothing has come, you can contact the company's line yourself.

The items include transfer account information. The notice does not describe the details, such as account numbers. PINs and passwords are not listed, but someone who knows your account details can more easily make a message that looks like a transfer notice (this site's view). Check your statement in your bank's app or passbook.

If an unexpected deposit arrives and you are told "I sent it by mistake, please send it back", do not send money yourself. Contact your bank first. The notice does not ask members to change their accounts; if you are worried, talk to your bank.

General warnings are available from the Japanese Bankers Association and the National Police Agency (both are general warnings in Japanese, not about this incident).

The items may include investment stock information, dividends and taxes, and holding balance. In general, someone who knows what you hold can make a convincing story, such as "your shares will fall", "a dividend procedure is needed" or "you can cash out your plan holdings".

For any request about plan procedures (leaving the plan, withdrawing, changing accounts, selling holdings), do not trust the contact details you were given; check with your administration office or the company's official line yourself.

The company blocked access to the system and suspended the service on November 9. It says it will announce the restart through individual contact and its website. No restart date is given. The notice does not say how procedures such as contributions or withdrawals are affected while the system is stopped, so ask your administration office.

The line given in the notice is SMBC Nikko Securities' inquiry line 0120-715-250 (weekdays 9:00 to 18:00, weekends and holidays 9:00 to 17:00, Japan time). Use the number in the official notice, not one written in a message or letter.

If you gave account details or personal information to a suspicious contact, or sent money, contact your bank immediately. You can also call the police consultation line (#9110) or the consumer hotline (188) in Japan. For suspicious activity on accounts, see How to check for unauthorized access.