TRADE WORKS (TSE Standard: 3997) said a third party exploited a misconfigured management function in the internet trading system it supplies to Iwai Cosmo Securities, and that data on up to 4,611 of the brokerage's online-trading customers may have leaked. The company called the cause its own inadequate management.
What leaked, and what did not
TradeWorks detected the unauthorized access on 14 October 2026 and took emergency measures such as access restrictions. As of 16 October, the number of customers whose information may have leaked was 4,611. The data covers names, email addresses and other items.
Customer logins are protected by multi-factor authentication and passkeys, and the company says ordinary login routes were not breached. The attacker instead used a configuration flaw in part of the system's management functions. TradeWorks says it has not confirmed that customer passwords were obtained through that function. It adds that the possibly leaked data alone cannot be used to log in to securities accounts or trade, and that no secondary damage has been confirmed.
Iwai Cosmo Securities has issued warnings on its website and has already notified the affected customers individually. The vendor urges customers to be wary of suspicious calls or emails posing as the brokerage.
Who pays
TradeWorks says it intends to bear all losses and response costs, and is discussing specifics with the parties involved. The compensation amount is under review. The company expects its cyber insurance to apply, though it does not say cover is confirmed. The notice gives no figure for the effect on earnings; the company says it is reviewing the impact and will disclose promptly if anything requires it.
Checks beyond one client
On the day the problem surfaced, TradeWorks disabled the abused management function, invalidated connections established illegitimately, blocked traffic from the source of the attack and strengthened countermeasures based on the attacker's characteristics. It is also checking other financial institutions that use its system and implementing necessary measures. It reports no similar incident so far, and says checks, including by an external specialist body, continue.
At Iwai Cosmo Securities' request, TradeWorks will re-inspect vulnerable points and work with the brokerage and external specialists on stronger security management and prevention of recurrence. It will also share information about the attack with relevant agencies.