A cyberattack on the systems of an outsourcing partner of IwaiCosmo Securities Co., an Osaka-based brokerage, led to the execution of unauthorised buy and sell orders across multiple client accounts, the company confirmed on October 20, 2026.
The firm said false orders were placed on seven accounts, with trades carried out in five of them. IwaiCosmo Securities stated it had reversed the affected transactions and restored the system to its prior state, with no financial loss sustained by its clients, according to a report by The Yomiuri Shimbun.
The breach did not originate within the brokerage’s own infrastructure. Instead, attackers compromised a system at its outsourcing company. That distinction is significant for brokers and underwriters assessing where cyber liability sits when vendor networks are the point of entry.
IwaiCosmo Securities also disclosed on October 16, 2026, that the same outsourcing partner’s breach had exposed the personal data of clients using its internet trading services. By October 20, 2026, the company had confirmed the names, email addresses, and other information of 4,975 individuals had leaked. It said the leaked personal data was not used in the unauthorised trade orders.
The IwaiCosmo incident is the latest in a sustained wave of cyberattacks targeting Japan’s securities sector. Between January and April 2025 alone, approximately 6,380 brokerage accounts were hijacked and 3,505 unauthorised transactions were recorded, with fraudulent sales totalling roughly ¥161.2 billion and purchases reaching approximately ¥143.7 billion, according to figures cited in a press conference by Japan’s Minister of State for Financial Services, Kato Katsunobu.
“The damage caused by unauthorized access and unauthorized transactions has been increasing rapidly,” Kato said in May 2025, adding that the government intended to prevent such damages “with strong determination.”
The FSA has continued to update its public warnings on unauthorised access to internet trading services as recently as June 2026, signalling that the problem remains active.
By mid-2025, the FSA had recorded 7,139 illegal financial transactions, with proceeds from fraudulent securities sales reaching ¥571 billion, according to Nippon.com. Attackers used phishing and malware to steal login credentials before manipulating client portfolios.
Read more: Aflac Japan breach exposes millions of customer records
The earlier wave of attacks in Japan primarily involved compromised individual brokerage accounts. The IwaiCosmo case is different because the intrusion came through a third-party vendor’s system and affected the brokerage’s trade management platform directly, resulting in orders the firm’s own clients never placed.
That escalation from data theft to direct interference with trading activity creates a compounding of exposure. For cyber insurers, it raises a practical question: does the policy respond to both the data breach notification costs and the financial losses from unauthorised transactions triggered through a vendor’s compromised system?
A 2025 report by SecurityScorecard found that 41.8% of breaches affecting leading fintech companies originated from third-party vendors, with fourth-party exposures accounting for an additional 11.9%.
“Maintaining trust in financial services is a prerequisite for financial transactions,” Kato told reporters in the same May 2025 press conference.
Japan’s FSA has been working with the Center for Financial Industry Information Systems (FISC) on revisions to cybersecurity guidelines for financial institutions, including standards governing outsourced systems.
Read more: INTERPOL maps the cybercrime ecosystem that Asia’s insurance market is still pricing too cheaply
For brokers placing cyber cover for financial institutions in Asia-Pacific, the IwaiCosmo breach is a concrete example of how a vendor compromise can move beyond data exposure and into the manipulation of core operations.
Global cyber premiums are projected to reach approximately US$16.4 billion in 2026, according to Swiss Re estimates cited by Marsh, and 70% of organisations experienced at least one material third-party cyber incident in the past year, based on the same Marsh survey.
The question for brokers is whether their clients’ policies adequately respond when the breach originates outside the insured’s own systems and results in direct financial interference rather than just data loss.
IwaiCosmo Securities has not disclosed the identity of the outsourcing firm involved or provided further detail on how its trade management system was accessed.
