Hackers Placed Trades in IwaiCosmo Customer Accounts, and the Broker Left It Out of Its First Breach Notice

Attackers who broke into the company running IwaiCosmo Securities' online trading system did more than read customer data. On October 14 they also hit the broker's trade management system and pushed buy and sell orders through seven customers' accounts. Five of those orders executed.

They are believed to be the first unauthorized trades in Japan's financial industry during the current wave of cyberattacks, Kyodo reported. A breach at a single back office vendor reached all the way into customers' trades, and the public only learned about it six days later.

Two notices, two different stories

IwaiCosmo's first public notice, on October 16, talked about leaked names and email addresses. The trades came out on October 20, in a second notice that also raised the number of affected customers by 364, from 4,611 to 4,975.

The broker explains the gap. When it published the first notice, measures to stop the same attack were still being rolled out step by step, so it held back anything that could point to the method. Once the countermeasures were in place and checked, it disclosed the trades and apologized for the delay in explaining them.

It also moved quickly for the customers hit. IwaiCosmo contacted all seven individually on October 14, restored their accounts to their state before the trades, and says none of them bore any cost.

Not an account takeover

The break-in was at Trade Works Co., the Tokyo firm contracted to operate and maintain IwaiCosmo's internet trading system. In a report published October 21, IwaiCosmo says a malicious third party exploited a system vulnerability and ran a brute force attack. The broker detected it on October 14 and cut off the traffic the same day, but five orders executed before the block.

The trades did not use the leaked personal data, and the attackers did not log in as customers. IwaiCosmo says passkey authentication was not broken, and the leaked data did not include trading PINs, so it cannot be used to log in or trade. Account takeovers like the ones that have hit other Japanese brokerages since last year are not possible on its platform, it says, because passwords are masked, multi factor login is mandatory and login security has been tightened. It reported no similar incidents in the Financial Services Agency's monthly unauthorized trading figures since May last year.

Still, the 4,975 customers' records were viewable by the attacker until the block. IwaiCosmo told them to watch for suspicious emails and urged everyone to set up passkeys and multi factor authentication.

Trade Works says it has found and fixed the cause. It added access restrictions on admin functions, stronger blocking of illicit traffic, instant detection of login anomalies and tighter monitoring. It also checked the systems it provides to other financial institutions and found no similar access.

Tokyo wants answers

Chief Cabinet Secretary Minoru Kihara told reporters that the Financial Services Agency has asked IwaiCosmo to analyze the break-in and draw up preventive measures. Kyodo says the attack is believed to have been carried out with the help of artificial intelligence.

The incident lands in a country already reeling from supplier breaches, after JR East, Lawson and Times Car were hit earlier. On Wednesday, the National Police Agency said data tied to 22 prefectural police forces, including about 125,000 records on officers and staff, may have leaked through disaster information firm Arcadia Inc. Recruit disclosed a possible leak involving 3.7 million accounts at its Carsensor used car service, leading Nissan and Mitsubishi Motors to suspend used car services that rely on Recruit's system.

At IwaiCosmo, the seven accounts were put back the way they were. What stays is the route the attackers took, through a vendor's system and into customers' trades.

Some offers on this page may be paid placements or contain affiliate links.