Scala Communications (i-ask FAQ system: Daiwa Securities, Citizen Watch and others) data breach

What happened

Scala Communications said an outsider logged in to the admin site of its i-ask FAQ system between about 8:30 pm on October 2 and 8 am on October 3, 2026, planted a malicious program and may have taken customer inquiry data stored for up to five client companies on the same server. Up to 713,126 inquiry records may have leaked, counted per inquiry with duplicates included; the data includes names, email addresses and inquiry content, depending on the client. Daiwa Securities said data on about 110,000 of its customers may have leaked, including names, email addresses and securities account numbers, though it says this alone cannot be used to access accounts or trade. Citizen Watch said about 100,000 records across its Citizen, Bulova and Frederique Constant brands may be involved, and Sompo Japan said up to about 60,000.

What should I do?

1. Never give trading IDs, passwords, PINs or one-time passwords to anyone who contacts you about this incident; Daiwa has warned of fake emails and calls.
2. Treat messages that quote a past inquiry you made as suspect, and contact the company through the contact details on its official website.
3. Don't open links or attachments in unexpected messages that claim to be from these companies.

More data breaches in Japan →

Check the other services you use →