Investors who bought Kintetsu Group Holdings’ July 2026 corporate bond, or two older “perk” bonds sold by Rakuten Securities, should treat any message about those purchases with suspicion this weekend. The NTT Data breach disclosed on Saturday 31 October hit a subcontractor’s system used to hand out bond-holder perks, and several Japanese brokers say their customers’ names and purchase amounts may have been taken.
NTT Data said it has suspended STdirectServices, a service that “supports the granting of perks to corporate-bond purchasers”, after a third party gained unauthorised access to a SaaS service run by one of its subcontractors. Personal information handled by that service may have leaked, and the subcontractor is investigating, the company said. NTT Data has not named the subcontractor.
In brief
- A subcontractor’s platform behind NTT Data’s STdirectServices bond-perk service was accessed by a third party; NTT Data has suspended the service.
- SBI Securities and MUFG Morgan Stanley say buyers’ names and purchase amounts may have leaked, and Rakuten Securities counts up to 362 records; the brokers say login details and passwords were not included.
- The subcontractor, the method of attack and the overlap between firms’ counts are all unknown.
How the NTT Data breach reached bond investors
The brokers describe the affected system as a “digital securities platform” provided by NTT Data’s subcontractor and used for perk applications on so-called digital-perk bonds. Each firm has published its own figures, and they cover different groups of customers.
Rakuten Securities said the incident occurred on Friday 30 October and that NTT Data told it information inside the platform may have been taken out. Up to 362 records are involved, counted per holding, across three bonds it sold: Kagome’s first unsecured bond (issued February 2023) and West Japan Railway’s 80th unsecured bond (June 2024), for some buyers of each, and Kintetsu Group Holdings’ 135th unsecured bond (July 2026), for buyers of ¥1m or more. Rakuten said login IDs, passwords and trading details were not part of the data, and that no unauthorised logins or trades linked to the incident have been found.
SBI Securities said 1,169 of its customers who bought the Kintetsu bond are affected, and MUFG Morgan Stanley Securities said 95 of its customers are. Both said the information that may have leaked is name and purchase amount, and that account numbers and passwords were not included. Kintetsu itself put the number of affected Kintetsu-bond investors at 2,678, Nikkei reported, a figure Kansai TV also reported.
For a small group the exposed data is wider. West Japan Railway said information on two investors in its 80th bond may have leaked, including name, address, phone number, email address, gender and date of birth.
What affected bond investors should do
Every firm involved gives the same core warning: expect fraudsters to pose as them. Rakuten, SBI and MUFG Morgan Stanley all urge customers not to click links or enter personal details in unexpected emails, text messages or calls about the incident. JR West says it will never ask investors for passwords, credit card details or PINs.
The practical steps are simple. Treat any message that mentions your bond purchase, a perk, a “compensation” offer or a security check as suspect, even if it quotes the right bond and amount. Reach your broker only through its app or a website address you type yourself. Rakuten is asking customers to switch on passkey login, which resists phishing better than a password. Brokers say they will contact affected customers individually.
Names and amounts are the phisher’s opening line
The data at stake here looks modest: a name and how much someone paid for a bond. That is exactly what makes it useful to a fraudster. A message that greets an investor by name and refers correctly to a ¥1m Kintetsu bond purchase reads like genuine broker correspondence, and it singles out people who have shown they have money to invest. Phishing does not need a password if it can persuade the target to type one in.
The case is also a clean example of fourth-party risk. Investors dealt with their broker; the broker used NTT Data’s perk service; NTT Data relied on a subcontractor’s SaaS platform. Rakuten, SBI and MUFG Morgan Stanley each stress that their own systems were not accessed, and that is true, but customers’ data still sat two contracts away from the firm they chose. For regulated brokers, the questions that follow are about oversight: how far down the chain due diligence reaches, and how quickly a sub-supplier’s incident reaches the firm that owns the customer relationship.
The counts also show why the totals should be read with care. Rakuten’s 362 is counted per holding, so one person can appear more than once, and nobody has said how far the brokers’ lists overlap with Kintetsu’s reported 2,678. Treat each figure as that firm’s own.
Part of a run of Japanese data breaches
The disclosure adds to a heavy month for Japanese companies, tracked on TSN’s ransomware and cyber attacks hub. On Friday Muji’s owner said its app breach may have exposed up to 27.26m records, and this week Japan Airlines said booking data on about 92,000 customers was exposed through its supplier Amadeus. Earlier, a cyberattack on cloud provider Arcadia may have exposed details of Japanese police staff, and TSN has logged a wider wave of breach notices from Bookoff, Lawson and others. Several of these, like this one, ran through a supplier rather than the company customers knew.
NTT Data says no bonds are currently due perks, so the suspension has no effect on perk delivery. The open questions are the subcontractor’s name, how it was breached and when the intrusion began. Rakuten says the subcontractor is still investigating the route in and the technical cause.
Sources
- NTT Data: STdirectServicesのサービス停止についてのお知らせ (Notice of suspension of STdirectServices), 31 Oct 2026 (Japanese)
- Rakuten Securities: 外部サービス提供元への不正アクセスによるお客様情報漏えいの可能性について, 31 Oct 2026 (Japanese)
- SBI Securities: 当社が取り扱った社債に関する投資家情報の漏えいの可能性について, 31 Oct 2026 (Japanese)
- MUFG Morgan Stanley Securities: 当社が取り扱った社債に関する投資家情報の漏えいの可能性について, 31 Oct 2026 (Japanese)
- West Japan Railway: 外部サービスへの不正アクセスによる投資家様情報漏えいの可能性について, 31 Oct 2026 (Japanese, PDF)
- Nikkei: 近鉄GHD、投資家情報2678件漏洩か, 31 Oct 2026 (Japanese)
- Kansai TV: 近鉄グループホールディングス 社債購入者の個人情報が漏えいした可能性, 31 Oct 2026 (Japanese)
Related stories
- Muji Says App Breach May Have Exposed Up to 27.26m Customer Records
- JAL Says Amadeus Breach Exposed Booking Data on 92,000 Customers
- Arcadia Breach May Have Exposed Data on 125,000 Japanese Police Staff
- Japan’s Data-Breach Wave: What Bookoff, Times Car, skyticket, Lawson, Resorttrust and Others Have Admitted
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
