Japan's Iwai Cosmo Securities reports unauthorised trades in 5 accounts after cyberattack
In short
Iwai Cosmo Securities said its online trading system, run by contractor Tradeworks, was attacked, and orders were placed in 7 customer accounts without the customers' intent, with trades executed in 5. The company said it has restored the accounts and customers bore no financial burden, but the names and email addresses of 4,975 customers were leaked. Japanese media said AI may have been used in the attack, which Tradeworks said it cannot assert.
Read the full story 2 min read
Iwai Cosmo Securities in Japan announced that its online trading system had been hit by a cyberattack and that trades the customers did not intend were executed. According to Korean reports citing Kyodo News and Tokyo Shimbun, orders were placed in 7 customer accounts and trades were completed in 5 of them. The company said it has restored the accounts to their state before the trades and that customers bore no financial burden. [ 1 , 2 , 3 , 4 ]
The company also confirmed that the names and email addresses of 4,975 customers were leaked. It said the leaked personal data was not used in the unauthorised trades and that online trading passwords were not part of the leaked information. Iwai Cosmo apologised to customers and others concerned for the inconvenience and worry. [ 1 , 2 , 3 ]
The unauthorised access occurred on the system of Tradeworks, which operates and maintains the online trading system for Iwai Cosmo. Newsis said the first detection and emergency measures such as access restrictions came on 14 October. Tradeworks said regular unauthorised logins were blocked, but a gap in the settings of an administrative function was exploited by a third party. It said no similar incident had been confirmed at its other clients. Tradeworks provides online trading systems to firms handling securities, margin foreign exchange and cryptocurrency. [ 1 , 2 , 3 ]
Newsis, citing Mainichi, said the trading management system, which passes customer orders to Iwai Cosmo, was presumably hacked. Iwai Cosmo said it appeared a malicious third party exploited a vulnerability in a brute-force attack, and that an administrator ID and password were likely leaked through Tradeworks' settings gap and the attack. Reports differ on who detected the intrusion: Yonhap said the securities firm detected it, Newsis in one report said Tradeworks did, and Newsis in a later report said Iwai Cosmo detected it and notified Tradeworks. [ 1 , 2 , 4 ]
Tradeworks said it could not assert that AI was used in the attack. Local media nonetheless said AI use was possible because of the brute-force nature of the attack, Yonhap reported. Tradeworks also said it had seen attacks of a frequency and type not seen before, and that the attackers' more sophisticated methods contributed to the breach. [ 1 , 4 ]
Chief Cabinet Secretary Minoru Kihara said at a press conference on 21 October that the government is investigating and that the Financial Services Agency had asked Iwai Cosmo to analyse the cause and prepare measures to prevent a recurrence. Kyodo reported that this appears to be the first confirmed case, among recent unauthorised access incidents in Japan, in which a financial institution suffered harm. Yonhap said the Japan Securities Dealers Association, working with the agency, will check the trading systems of securities firms, including small and regional ones judged to have weak safeguards, and help them prepare responses. [ 1 , 2 , 3 ]
Why it matters
Chief Cabinet Secretary Minoru Kihara said the government is investigating, and the Financial Services Agency has asked Iwai Cosmo for a cause analysis and preventive measures. The Japan Securities Dealers Association said it will support checks of member firms' trading systems, so the case may prompt wider security reviews in the sector.
Key facts
- Iwai Cosmo Securities said its online trading system was hit by a cyberattack, and orders were placed in 7 customer accounts without the customers' intent. [ 1 , 2 , 3 , 4 ]
- Trades were executed in 5 of the 7 accounts. [ 1 , 2 , 3 , 4 ]
- The company said it has returned the accounts to their state before the trades and that customers bore no financial burden. [ 1 , 2 , 3 , 4 ]
- The names and email addresses of 4,975 customers were leaked. [ 1 , 2 , 3 ]
- The company said the leaked personal data was not used in the unauthorised trades and online trading passwords were not among the leaked data. [ 2 , 3 ]
- Tradeworks, which operates and maintains the online trading system for Iwai Cosmo, said a gap in the settings of an administrative function was exploited by a third party. [ 2 , 3 ]
- Chief Cabinet Secretary Minoru Kihara said the Financial Services Agency asked Iwai Cosmo to analyse the cause and prepare measures to prevent a recurrence. [ 1 , 2 , 3 ]
Confirmed by several sources
- Orders were placed in 7 customer accounts without the customers' intent and trades were executed in 5 of them. [ 1 , 2 , 3 , 4 ]
- Iwai Cosmo said it has restored the accounts to their pre-trade state and customers bore no financial burden. [ 1 , 2 , 3 , 4 ]
- The names and email addresses of 4,975 customers were leaked. [ 1 , 2 , 3 ]
- Chief Cabinet Secretary Minoru Kihara said the Financial Services Agency asked Iwai Cosmo for a cause analysis and preventive measures. [ 1 , 2 , 3 ]
- Tradeworks said it cannot assert that AI was used in the attack, while local media said AI use is possible. [ 1 , 4 ]
Still unclear
- Whether AI was used in the attack. Yonhap and Newsis cite local media, including Mainichi, saying AI use is possible. Tradeworks said it cannot assert this, and no document confirms it.
- Who detected the unauthorised access on 14 October. One report says Iwai Cosmo detected it and notified Tradeworks, while another says Tradeworks detected it and took emergency measures.
- How the attackers gained access. Iwai Cosmo said a brute-force attack likely leaked an administrator ID and password, and Tradeworks said an administrative function was misconfigured. The newsis report describes the trading management system as presumably hacked, and no document gives a final finding.
What local media are saying
Timeline, local time
- Yonhap reported on 21 October that Iwai Cosmo had announced unauthorised trades in 5 accounts after a cyberattack. [ 1 ]
- Newsis reported on 21 October the 4,975-customer data leak and Kihara's remarks at a press conference. [ 2 ]
- Dong-A Ilbo published the same report on 22 October. [ 3 ]
- Newsis reported on 22 October, citing Mainichi, that AI-assisted attack was possible and that the company said a brute-force attack was suspected. [ 4 ]