2026-10-26
Green Monster's FX Navi app possible data leak (about 6.19 million records): email addresses and survey answers among the items, and what users should do
On October 23, 2026, Green Monster Inc. (Tokyo Stock Exchange Growth, 157A), announced that user information from its FX demo-trading app FX Navi (FXなび) may have been obtained by an outside party (first report). On October 17 it found unauthorized access to the app by an outside party and began investigating. In that investigation it found that, from around 20:26 on April 27 to around 14:26 on April 30, an outside party using a different IP address may have continuously obtained user information from the app. It says no leak from the October 17 access itself has been confirmed. About 6.19 million records may have been obtained, including data that is not personal information. The items are email address (66,003), nickname, gender, age group, occupation category, X (formerly Twitter) ID (6,434), self-introduction text, icon image URL, answers to the first-launch survey (4,809,631), device ID, login credentials, account transfer code (5,120), push notification identifier, advertising ID, source IP address and usage data such as trading results. Name, address, phone number, date of birth, credit card, bank account and My Number (Japan's national ID number) are not items users can register. The company says the cause was a function of the app's API; it fixed the API function and the login credentials and invalidated all login credentials issued before the fix. No secondary harm has been confirmed. This site's conclusion: FX Navi users should not open links or attachments in emails or X messages claiming to be from the company or related firms, and should treat every investment solicitation as fake.