Japanese brokerage IwaiCosmo Securities disclosed on Tuesday, October 21, 2026, that it experienced a significant cybersecurity breach resulting in unauthorized trades in client accounts [1]. The breach occurred at Trade Works, the operator of IwaiCosmo's online trading system, and compromised personal data belonging to 4,975 individuals [1]. The unauthorized access led to unapproved transactions being executed in affected client accounts, representing a serious breach of trading system security [1].
Following the discovery of the breach, IwaiCosmo took action to restore affected client accounts [1]. However, the incident raises significant concerns about the security infrastructure of Japan's financial services sector and the vulnerability of third-party system operators handling sensitive trading platforms. The breach affected nearly 5,000 clients, making this a substantial incident in terms of customer impact and potential financial exposure for the brokerage.
CONCLUSION
IwaiCosmo Securities' cyberattack represents a high-impact security incident affecting approximately 5,000 clients through unauthorized trades executed via a compromised third-party system operator [1]. The incident underscores critical vulnerabilities in financial services cybersecurity and may prompt regulatory scrutiny and increased security requirements across Japan's brokerage industry.