Iwai Cosmo Says Attack Placed Unauthorised Trades

Japanese brokerage Iwai Cosmo Securities has disclosed that a cyberattack placed buy and sell orders its customers did not make in seven online trading accounts, five of which were executed. In a notice dated 20 October, the firm said the attack hit a trade-management system on 14 October, the same day a supplier’s system was breached.

The disclosure turns what had been reported as a data leak into a case of trades placed without customers’ consent. Iwai Cosmo also raised the number of customers whose information was exposed to 4,975, and said it had held back details of the trades for nearly a week while defences were put in place. It said customers bore no cost.

In brief

Iwai Cosmo Securities says an attack on 14 October placed orders customers did not intend in 7 accounts, 5 of which were executed.
The accounts have been restored to their pre-trade state, and the firm says customers bore no cost.
The number of customers whose names, email addresses and other details leaked has risen to 4,975.

Seven accounts traded, five orders filled

According to the 20 October notice, the trade-management system was attacked on 14 October, when the unauthorised access also took place. Orders the customers did not intend were placed in seven accounts, and five of those accounts saw trades executed, the firm said. It did not say which securities were traded or how much the orders were worth.

Iwai Cosmo said it contacted the affected customers individually on 14 October and has returned their accounts to the state they were in before the trades. “Customers have not borne any cost,” the notice said (TSN translation of 「お客様のご負担は生じておりません」). The firm added that the trades did not use the leaked personal information.

The company also explained the delay. At the time of its first notice on 16 October, it was still rolling out measures to prevent similar damage, so it withheld information that could point to the method used, according to the second notice. Having finished and checked those measures, it apologised for the late explanation.

Leak tally rises to 4,975 customers

The breach began at TradeWorks, the company Iwai Cosmo uses to run and maintain its online trading system. The first notice said unauthorised access was detected on 14 October and that the information of 4,611 customers had leaked, with no secondary damage confirmed.

After re-examining access and communication logs with TradeWorks, Iwai Cosmo found that the information of 364 more customers had leaked, bringing the total to 4,975. The firm said these cases stemmed from the original intrusion, not from a new one. The data includes names, email addresses and other details, but no trading PINs, and Iwai Cosmo says it cannot be used to log in to accounts or trade.

Item	16 Oct notice	20 Oct notice
Customers whose data leaked	4,611	4,975
Accounts with unintended orders	Not disclosed	7
Accounts with executed trades	Not disclosed	5

Source: Iwai Cosmo Securities notices of 16 and 20 October 2026 (TSN translation).

Fixes in place, other clients checked

Iwai Cosmo says its online trading system is now running stably and the flaw behind the intrusion has been found and fixed. TradeWorks has added access restrictions on administrative functions, stronger blocking of illicit traffic, instant detection of login anomalies and tighter monitoring, according to the notice, and no new leak has been found since.

TradeWorks also checked the systems it supplies to other financial institutions. According to TradeWorks, as relayed by Iwai Cosmo, no similar unauthorised access was found. The Osaka-based broker’s planning department told Asahi Shimbun it was working to find the cause and prevent a recurrence while continuing monitoring and checks, and Asahi reported that TradeWorks, which is based in Tokyo, said no wrongdoing had been confirmed at other institutions as of 20 October.

Our read

This is TSN’s analysis. The bigger lesson here is about suppliers. A breach at an outsourced system operator reached far enough to place trades in customer accounts, and the full picture emerged in stages over six days. For brokers that rely on shared trading platforms, the test is whether supplier access to order systems is watched as closely as their own staff’s.