Iwai Cosmo Securities says cyberattack led to unintended orders in 7 accounts
In short
Iwai Cosmo Securities (岩井コスモ証券) of Osaka said on 20 October that a cyberattack on its trading system led to orders customers did not intend in 7 accounts, 5 of which were executed. The company said it has restored the accounts to their pre-trade state and that customers bear no burden. Names and email addresses of 4,975 people have also leaked.
Read the full story 1 min read
Iwai Cosmo Securities (岩井コスモ証券), based in Osaka, said on 20 October that its trading system had come under a cyberattack and that orders customers did not intend had been placed. According to the company's announcement, the unintended orders affected 7 accounts, and trades were executed in 5 of them. [ 1 , 2 , 3 , 4 , 7 ]
The company said it contacted the customers individually and had already returned the accounts to their pre-trade state. It said no burden had fallen on customers. [ 1 , 2 , 3 , 4 , 7 , 8 , 9 ]
Asahi Shimbun reported that Trade Works (トレードワークス) of Tokyo, which operates and maintains Iwai Cosmo's online trading system, detected the attack on 14 October and took emergency measures such as access restrictions. Its investigation then found that unauthorized trades had gone through and that the names and email addresses of 4,975 people had leaked. Nikkei reported the figure was 364 higher than at the company's 16 October announcement. [ 1 , 4 , 7 ]
The company said the unauthorized trades did not use the leaked information. Asahi reported that leaks of PINs and other details needed for online trading had not been confirmed. [ 1 , 3 , 4 , 6 , 7 ]
TBS and Nikkei reported that the cause of the unauthorized access had been fixed and that the online trading system was running. Nikkei said Trade Works had added measures such as a mechanism to detect login anomalies, and Asahi said it had strengthened functions that block unauthorized communications. A company representative told Asahi: "We are continuing monitoring and inspection while working to identify the cause and prevent recurrence." [ 1 , 3 , 4 ]
Trade Works also handles online trading operations for other financial institutions. As of 20 October it said no fraud had been confirmed there. [ 1 , 4 ]
Why it matters
The case shows an attack on a contractor's system reaching customer accounts at a securities firm. Outlets report that the contractor, Trade Works (トレードワークス), also runs online trading systems for other financial institutions, where no fraud had been confirmed as of 20 October.
Key facts
- Iwai Cosmo Securities said on 20 October that unintended orders were placed in 7 customer accounts and executed in 5. [ 1 , 2 , 3 , 4 , 7 , 8 , 9 ]
- The company said it contacted customers individually and returned the accounts to their pre-trade state, and that no burden fell on customers. [ 1 , 2 , 3 , 4 , 7 , 8 , 9 ]
- Trade Works (トレードワークス), which operates and maintains Iwai Cosmo's online trading system, detected the attack on 14 October. [ 1 , 4 , 8 ]
- Names and email addresses of 4,975 people were confirmed leaked as of 20 October. [ 1 , 2 , 4 , 7 ]
- The company said the unauthorized trades did not use the leaked personal information. [ 1 , 3 , 4 , 6 , 7 ]
- Trade Works said no similar fraud had been confirmed at other financial institutions whose systems it handles. [ 1 , 4 ]
Confirmed by several sources
- Unintended orders were placed in 7 accounts at Iwai Cosmo Securities, and trades were executed in 5 of them. [ 1 , 2 , 3 , 4 , 7 , 8 , 9 ]
- The accounts were returned to their pre-trade state, and the company said customers bear no burden. [ 1 , 2 , 3 , 4 , 7 , 8 , 9 ]
- The names and email addresses of 4,975 people were confirmed leaked as of 20 October. [ 1 , 2 , 4 , 7 ]
- The company said the unauthorized trades did not use the leaked personal information. [ 1 , 3 , 4 , 6 , 7 ]
Still unclear
- How the attackers carried out the unauthorized orders. The documents say the company is investigating the cause; Asahi quotes a company representative saying it is working on cause identification and recurrence prevention, while TBS and Nikkei say the cause of the unauthorized access has been fixed.
- Whether online trading passwords were exposed. Asahi reports that leaks of PINs and other credentials needed for online trading have not been confirmed; other documents do not address this.
What local media are saying
Timeline, local time
- Asahi Shimbun published its report on 20 October that the company and Trade Works had disclosed the attack. [ 1 ]
- Nikkei published its report on 20 October that the company announced unauthorized trades in 5 accounts via its contractor. [ 4 ]
- NHK published its report on 21 October on the company's announcement. [ 9 ]