Japan Brokerage IwaiCosmo Reports Unauthorized Trades After Cyberattack on Trading System

IwaiCosmo Securities Co., an Osaka brokerage, disclosed on October 20, 2026, that unauthorized buy and sell orders had been placed through seven customer accounts after a cyberattack on the online trading system operated by its outsourced provider Trade Works Co. Five of those orders were executed, the company said, in a case that Kyodo News described as believed to be the first in Japan's financial industry in which attackers reached a brokerage's core trading system and manipulated transactions.

The incident did not begin as a trading failure. According to the disclosures, Trade Works detected unauthorized access to its systems on October 14, 2026, and IwaiCosmo soon found that customer names and email addresses had been exposed. The brokerage initially reported on October 16, 2026, that 4,611 customers might be affected, then raised the figure to 4,975 after a reinvestigation added 364 people.

The affected accounts were restored to their condition before the unauthorized trades, and IwaiCosmo said customers bore no losses. The leaked information did not include trading passwords or PINs, and the company said it could not be used to log in to securities accounts or to place trades. Trade Works said customer logins were protected by layered authentication, including multifactor authentication and passkeys, and that the intrusion came through an administrative function rather than a normal customer login route.

The case has drawn attention because it appears to cross a line that security experts have long warned about. Data breaches at brokerages are serious but familiar. An attack that alters the order flow inside a trading system is different, because it touches the machinery that turns customer intent into market transactions. The disclosure came after a week in which IwaiCosmo and Trade Works gave partial notices, first about data exposure and later about the unauthorized trades.

Key Facts

Kyodo News reported on October 20, 2026, that unauthorized buy and sell orders were placed through seven customer accounts and executed in five. The Osaka based brokerage said it had already restored the affected accounts, returning each to its state before the unauthorized trades, so affected customers bore no losses. The orders were placed after Trade Works, which operates and maintains IwaiCosmo's online trading system, was hit by an unauthorized access incident.

The personal data figure moved during the week. Trade Works said in a JPX disclosure dated October 16, 2026, that 4,611 customers' names, email addresses and other information may have leaked. IwaiCosmo later said a reinvestigation added 364 people, bringing the total to 4,975. The company said the leaked data did not include trading passwords or PINs and could not be used to log in or trade.

Trade Works, listed on the Tokyo Stock Exchange Standard Market under code 3997, said it detected the unauthorized access on October 14, 2026, and imposed emergency measures including access restrictions. In its October 16, 2026 filing, it said customer logins were protected by multifactor authentication and passkeys, and that unauthorized logins through the normal route were prevented. The problem, it said, was a configuration flaw in some administrative functions, which a third party exploited.

Nikkei reported on October 21, 2026, that a third party pretended to have administrative privileges and attacked the order management system operated by Trade Works. The report also noted that there is a view that artificial intelligence was used. IwaiCosmo's own notice dated October 21, 2026, described a malicious third party exploiting a vulnerability and launching a brute force attack, and stated that passkey authentication was not broken.

ITmedia News reported on October 21, 2026, that IwaiCosmo contacted affected customers individually on October 14, 2026, and restored their accounts to the pre trade state. The company disclosed the data leak on October 16, 2026, but held back the trading incident until October 20, 2026, because countermeasures were still being completed. Identification and fixing of the cause were complete, the online trading system was running stably and could be used normally, and monitoring and inspections were continuing.

Analysis

The immediate financial harm appears limited. Five trades were executed, but the accounts were put back to their earlier state and customers bore no losses. Trade Works said it would bear all losses and response costs, with cyber insurance expected to apply. That is a meaningful commitment, because it separates the customer from the cost of the intrusion and puts the burden on the system operator and its insurer.

The operational facts are more troubling. The attackers did not need a customer password, a trading PIN or a stolen passkey. According to Trade Works, they used a configuration flaw in an administrative function, and according to Nikkei, they pretended to have administrative privileges. IwaiCosmo said passkey authentication was not bypassed. What this really means is that the security model around the customer login was not the weak point in this case; the weak point was the privileged layer that sits behind it and manages orders.

That distinction matters for how the industry reads the event. Brokerages have spent years tightening customer authentication, adding multifactor checks and passkeys, and warning about phishing and account takeover. Those controls still matter. But an attacker who reaches an administrative plane can act on accounts without taking them over in the conventional sense. The customer sees an order that he or she did not place. The system sees a privileged action that looks legitimate until someone checks it against customer intent.

The speed of the response helped contain the damage, but the disclosure sequence shows the difficulty of communicating an incident while remediation is still underway. IwaiCosmo said it disclosed only the data leak on October 16, 2026, because countermeasures were still being phased in and it withheld information that could reveal the attack method. It then disclosed the trading incident on October 20, 2026. That is a defensible sequence in security terms, but it leaves customers and the market with a partial picture for several days.

Why It Matters

For Japan's financial industry, the case is a warning that the boundary between data security and transaction security is thinner than many assumed. Kyodo News reported that no previous case in Japan is known in which attackers penetrated a financial institution's core trading system and manipulated transactions. The Asahi Shimbun reported on October 21, 2026, that Masakatsu Morii, professor emeritus at Kobe University, said he had never heard of such a case in Japan and called it an attack on a completely different level from the leakage of personal information.

The expert warning extends beyond brokerages. Morii said the same approach could in some cases reach a bank's system and move funds, according to The Asahi Shimbun. That does not mean the IwaiCosmo incident involved bank systems; it means the technique is not easily confined to one type of institution. Trade Works said it checked systems it provides to other financial institutions and found no similar incidents as of October 20, 2026. The company also said no similar incidents had been detected among its other clients.

For customers, the practical risk is not only the five trades that were reversed. The exposed names and email addresses can support phishing that tries to exploit the credibility of a brokerage. IwaiCosmo urged customers to set up passkeys and multifactor authentication and warned that leaked email addresses could be targeted by phishing. The company said trading passwords and other critical information are masked, that multifactor authentication is mandatory at login, and that the kind of account takeover seen at other brokerages since last year was not possible here.

Next Up

The next test is whether the fixes hold and whether the industry treats the case as a one off or as a template. Trade Works said it suspended use of the abused administrative function, invalidated unauthorized connections, blocked communications from the attack source, and strengthened countermeasures tailored to the attacker's characteristics. It also added anomaly detection for logins, according to Nikkei. The online trading system remains in operation after security measures were strengthened to block unauthorized communications.

IwaiCosmo said that, according to FSA monthly disclosures, it had no similar unauthorized trading cases since May 2025, and it said the response was complete with no further spread of damage. The Japan Financial Services Agency is named in the company's account through those monthly disclosures, not through a new enforcement action described in the materials. The open questions are how quickly other brokerages and their outsourced operators review administrative privileges, and whether regulators and the public will treat the intrusion as a data breach that happened to touch trading or as a trading system attack that happened to expose data.