Key takeaways

  • On October 14, 2026, attackers placed buy and sell orders in seven customer accounts at Iwai Cosmo Securities (岩井コスモ証券), a mid-sized Osaka brokerage. Orders in five accounts were executed. The firm reversed them the same day, and customers bore no loss.
  • The attackers did not log in as the customers. Iwai Cosmo had made multi-factor authentication mandatory in 2025. They went through Trade Works (トレードワークス), the vendor that runs its online trading system, by exploiting a misconfigured administrative function and attacking the trade management system behind it.
  • Names and email addresses of 4,975 customers also leaked. Iwai Cosmo first disclosed only the leak, on October 16, and revealed the trades on October 20, saying it had held back details until countermeasures were in place.
  • On October 21, Chief Cabinet Secretary Minoru Kihara said the Financial Services Agency has asked Iwai Cosmo to analyze the cause and prepare measures to prevent a recurrence.
  • In our view, this is a different kind of attack from the account takeovers that hit Japanese brokers in 2025: it went around customer authentication, not through it. Trade Works also serves other financial institutions.

What happened#

Date Event
Sep 28, 2025 Iwai Cosmo makes MFA mandatory for logins to its online trading service, according to innovaTopia
Oct 14, 2026 Unauthorized access to Trade Works' system. The same day, an attack on the trade management system places orders in 7 accounts, 5 executed. Customers are contacted and the trades reversed
Oct 16 Iwai Cosmo and Trade Works disclose a data leak affecting 4,611 customers. The unauthorized trades are not mentioned
Oct 20 Second report: 364 more customers affected (total 4,975), and the unauthorized trades disclosed
Oct 21 The Chief Cabinet Secretary says the FSA has asked for a cause analysis and recurrence prevention

According to Iwai Cosmo's second report:

  • The leaked data is customers' names, email addresses and other details. It does not include trading PINs, and cannot be used to log in or trade.
  • The unauthorized trades did not use the leaked data.
  • Trade Works has fixed the cause, restricted access to its admin functions, strengthened blocking of malicious traffic, added immediate detection of login anomalies, and increased monitoring.
  • Trade Works says it checked the systems it provides to other financial institutions and found no similar access.

According to reports of Trade Works' October 16 disclosure, customer logins were protected by multi-factor authentication and passkeys, and the normal login route blocked the attackers. What they exploited was a misconfiguration in part of the admin functions of Trade Works' own system. Trade Works will bear the losses and response costs in full, according to those reports.

Not the 2025 account takeovers#

Japan's brokers spent much of 2025 fighting a wave of account takeovers. Attackers used credentials stolen through phishing and malware to log in as customers, sell their holdings and use the proceeds to buy small-cap stocks in Japan and abroad. The FSA's figures show the scale:

January 2025 – September 2026
Unauthorized logins 19,252
Unauthorized trades 10,642
Value of stocks sold in those trades about ¥437 billion
Value bought about ¥384 billion

The industry's answer was stronger customer authentication: MFA, passkeys and login alerts. By September 2026, the FSA recorded only two unauthorized trades in the month.

Iwai Cosmo's case shows the limit of that answer. Customer authentication protects the front door. The attackers here used a door customers never see: the administrative and back-office functions of the platform that executes their orders, run by a vendor.

What we don't know yet#

  • What the misconfigured admin function was, and how it let an attacker place orders in customers' accounts
  • How the attackers found it, and whether they used stolen credentials, a vulnerability or something else
  • What securities were bought and sold, and why only seven accounts were used
  • Which other financial institutions use the same Trade Works system
  • Whether the FSA will ask other users of the platform to check their own setups

Our analysis#

Authentication protects one door#

Japan's securities industry did the right thing in 2025: it made phishing-resistant authentication the norm for customer logins. But an attacker who wants to trade in someone's account does not need that person's login if the system that places orders can be reached another way. Admin consoles, operator tools, APIs between the broker and its platform vendor, and batch interfaces all act on customer accounts without any customer authentication. In our view, every function that can move money or place orders should be protected, logged and monitored at least as tightly as the customer login, and preferably more, because it acts on all accounts at once.

The vendor's misconfiguration is the broker's risk#

Iwai Cosmo did not run the system that was breached. Trade Works did, and it serves other firms too. This is the same pattern we have covered this month with NEC's contractor, the website builder Studio and the IDCF Cloud attack: one provider's weakness becomes every customer's incident. For a broker, outsourcing the trading platform does not outsource the responsibility to its customers, as the FSA's request to Iwai Cosmo makes clear.

Holding back the method, for four days#

Iwai Cosmo disclosed the leak on October 16 but held back the unauthorized trades until October 20, saying it did not want to reveal the method while countermeasures were being rolled out. There is a real argument for that: the same platform serves other firms, and describing the attack before it was closed could have invited copies. The customers concerned had been told on October 14. In our view, the delay was defensible as long as it was short and explained, as it was. But a first notice that describes only a data leak, when trades have already been placed in customers' accounts, gives investors and other firms an incomplete picture of the risk. A sentence saying that further damage was under investigation, without the method, would have served both purposes.

What this means for readers#

  • If you run or outsource a trading, payment or banking platform, list every function outside the customer login that can place orders, move money or change account details: admin consoles, operator tools, internal APIs and vendor access. Check who can reach each one, from where, with what authentication, and whether its use raises an alert.
  • Ask your platform vendor how its admin functions are configured and reviewed, and whether a misconfiguration at one client can affect others.
  • Monitor for trades without a matching customer session. Orders that appear without a corresponding login are a strong signal of this kind of attack.
  • If you are an Iwai Cosmo customer, the firm says your login details were not leaked and affected accounts have been restored. Be wary of emails using your name and email address.

Japanese terms at a glance#

Japanese Reading Meaning
売買管理システム baibai kanri shisutemu Trade management system
管理機能 kanri kinō Administrative function
設定不備 settei fubi Misconfiguration
意図しない売買注文 ito shinai baibai chūmon Orders the customer did not intend
約定 yakujō Execution (of an order)
取引暗証番号 torihiki anshō bangō Trading PIN
官房長官 kanbō chōkan Chief Cabinet Secretary