TRADE WORKS Co., Ltd. (TSE: 3997) published its third report on November 2, 2026. It covers unauthorized access to the internet trading system the company builds and runs for Iwai Cosmo Securities, an Osaka brokerage. On October 14 an attacker abused a misconfigured administrative function in the platform. The attacker placed buy and sell orders in seven customer accounts, and orders in five of them executed. Names and email addresses of 4,975 customers were also exposed. Trade Works first put the leak at 4,611 people. Iwai Cosmo raised it to 4,975 on October 20 after reviewing its logs again. The attacker never logged in as any customer. The attack went around customer authentication, not through it, which separates this case from the account takeovers that hit Japanese brokers in 2025.
What Happened
Both companies say an unauthorized third party got into the Trade Works-operated trading system on Wednesday, October 14, 2026. Iwai Cosmo says it spotted the access, alerted Trade Works and put emergency access restrictions in place. Trade Works says it cut the intruder off the same day.
The disclosures came out in stages:
- October 16: Trade Works and Iwai Cosmo disclosed a possible leak affecting 4,611 customers. Pulse Newswire reported the Trade Works filing that afternoon. The notice said the cause was "improper configuration" of an administrative function and that no passwords were known to have been obtained.
- October 20: Iwai Cosmo's second notice added 364 more customers, bringing the total to 4,975. These records were taken during the same October 14 intrusion and were found when the company reviewed its network traffic records as well as its access logs. The notice also revealed, for the first time, that the attacker had hit the trade management system (売買管理システム) that same day. Orders the customers did not intend were placed in seven accounts, and five executed. Iwai Cosmo says it contacted the affected customers on October 14, reversed the trades, and that customers bore no loss. The broker says it held back details of the trades until countermeasures were in place, so the method could not be copied.
- October 21: Japan Cyber Watch reports that Chief Cabinet Secretary Minoru Kihara said the Financial Services Agency had asked Iwai Cosmo to analyze the cause and prepare measures to prevent a recurrence. No FSA document on this has been published.
- November 2: Trade Works' third report repeats the cause and the customer impact. It lists the remediation completed and estimates losses at about ¥50 million (roughly $320,000).
Trade Works says it will bear all losses and response costs and expects its cyber insurance to apply. Its direct impact on financial results is still under review.
What Was Taken
- Personal data: names, email addresses and "other" fields for 4,975 Iwai Cosmo online trading customers. The count was 4,611 in the October 16 disclosures and 4,975 from October 20 onward. Both companies attribute the difference to the second log review, not to a new intrusion.
- Not taken, according to the companies: trading PINs and passwords. Iwai Cosmo and Trade Works both say the leaked data cannot be used to log in to accounts, trade, or transfer money.
- Trading activity: unauthorized orders in seven accounts, five executed, all reversed the same day. Iwai Cosmo says the leaked personal data was not used to place these trades.
Neither company has said exactly what the "other" fields contain. Treat the exposed email list as phishing material. Customers who receive messages about the incident may be targeted by attackers pretending to be the broker.
The Attack Technique
Neither company has published the exact misconfiguration or the attacker's tools. Here is what they have said:
- An administrative or maintenance function was meant to be reachable only from a restricted environment. Because of a configuration flaw, it was reachable from the internet. Japan Cyber Watch summarizes the third report as saying Trade Works admits its design and operations management were inadequate.
- The attacker used that function to view customer data. The attacker also attacked the trade management system behind it to place orders directly, without a customer session.
- Customer-facing defenses held. Iwai Cosmo had made multi-factor authentication mandatory in 2025, and Pulse Newswire reports that MFA blocked logins through normal routes. The Epoch Times and Safeguard both report that customer passwords, passkeys and MFA were not bypassed.
Safeguard has compared five official documents from the two companies and notes that they describe the cause in slightly different terms. Neither account has been retracted. Kobe University professor emeritus Masakatsu Morii told The Epoch Times he had "never heard of this in Japan," calling it "an attack on a different dimension from personal information leakage."
Remediation listed by the companies so far:
- disabled the abused function and cut off unauthorized connections
- set up an incident response headquarters
- inspected routes exposed to the internet
- ran vulnerability assessments and penetration tests, plus a combined review of source code and settings
- restricted access to admin functions and closed routes that bypassed its defenses
- strengthened login protection and blocking of malicious traffic
- added real-time detection of login anomalies and stepped up monitoring
- standardized its reporting criteria
Why It Matters
One vendor, many brokers. Trade Works supplies trading systems to other financial institutions. The company says it has checked those systems and found no similar access, and Iwai Cosmo repeats that claim. No outside party has confirmed it.
MFA does not protect the back end. Japanese brokers spent 2025 adding phishing-resistant login after a wave of account takeovers, and those controls worked here. They did not matter, because the attacker went in through the vendor's admin layer and placed orders as the platform itself.
Disclosure lag. Customers and the market learned of the leak on October 16. They learned on October 20 that the attacker had been able to trade. Holding back details while fixes are deployed is defensible, but anyone judging their exposure to a vendor needs to know that the first notice left out the most serious part.
Regulatory attention. If the FSA request reported by Japan Cyber Watch is accurate, expect closer scrutiny of how Japanese brokers oversee their outsourced trading platforms.
What Organizations Should Do
- Map every admin and maintenance interface on outsourced platforms. Ask your vendors for written proof that admin functions cannot be reached from the internet. Then check it yourself with an outside scan of the vendor-hosted ranges you can see.
- Require strong authentication and network limits on vendor admin access. Admin paths should need a company-managed device, an allowlisted network and phishing-resistant MFA. Configuration alone is not enough, because a single misconfiguration is exactly how this attack got in.
- Watch the order path, not just logins. Alert on orders that have no matching customer session. Also alert on orders that come from admin or maintenance contexts, and on bursts of trading across unrelated accounts. In this case, unauthorized trades were the most damaging outcome, and login monitoring could not have caught them.
- Review traffic logs as well as access logs during an investigation. Iwai Cosmo's count grew by 364 people only after network traffic records were examined. Scope estimates built on application logs alone may be too low.
- Write vendor contracts that cover reporting and liability. Set notification deadlines, a duty to share logs, a right to run penetration tests, and who pays for customer losses. Trade Works volunteered to cover costs here, and contracts should not depend on that.
- Prepare for phishing that uses the leaked email list. Warn affected customers that the firm will never ask for credentials by email. Watch for lookalike domains that pretend to be your brand.
Sources: TRADE WORKS Co., Ltd - Third Report on Unauthorized Access Response... | TRADE WORKS Co., Ltd - Notice of Unauthorized Access October 2026... | Iwai Cosmo Securities: Unauthorized Trades Placed Through a Vendor'... | Iwai Cosmo and Trade Works Breach: Admin Flaw, 4,975 Leaked, 5 Trad... | New Type of Cyberattack Allowed Unauthorized Trades at Japanese Bro... | 外部委託先への不正アクセスに伴うお客様情報の漏洩について（第2報）｜ご案内｜お知らせ｜岩井コスモ証券ネット取引 | 外部委託先への不正アクセスに伴うお客様情報の漏洩について（第2報）｜ご案内｜お知らせ｜ネット取引「コスモ・ネットレ」 | Trade Works Says Data of Up to 4,611 Iwai Cosmo Securities Customer...