SMBC Nikko Securities data breach
SMBC Nikko Securities announced a data breach on Nov 11, 2026 affecting about 56,487 people, exposing names, addresses and bank or financial details. It was caused by a cyberattack. No settlement or compensation has been announced.
Was I affected?
You may be affected if you belong to an employee stock ownership plan (mochikabukai) that your employer has SMBC Nikko administer; the company is contacting the affected plans individually.
| Announced | Nov 11, 2026 |
|---|---|
| When it happened | Unauthorized access detected November 9, 2026 |
| Country | Japan |
| People affected | 56,487 |
| Data exposed | Names, Addresses, Bank or financial details and Other details |
| Status | Confirmed by the company or a regulator filing |
What happened
SMBC Nikko Securities, one of Japan's largest brokerages, said on November 11, 2026 that an outsider broke into the system it uses to administer employee stock ownership plans for client companies, and that plan members' personal data leaked from it. It detected the access on November 9, cut off the system and suspended the service the same day. Up to 56,487 plan members are involved; the data that may have leaked includes the plan name, investment holdings, member ID number, name, address, dividends and taxes, holding balance and the bank account used for transfers, varying by member. Phone numbers and email addresses are not stored in the system, and the company says no secondary damage has been confirmed.
What should I do?
- Be wary of letters, calls or messages claiming to be from SMBC Nikko or your stock ownership plan, and check with the dedicated helpline (0120-715-250) or your employer's plan office before acting.
- Watch the bank account linked to your plan for transfers or withdrawals you don't recognize.
- Don't give passwords, PINs or one-time codes to anyone who contacts you about your plan holdings or dividends.
- Be suspicious of investment pitches that mention your shareholdings, since holdings and address data may be in the leak.
How Korea fines a breach this size
For comparison, Korea's privacy regulator fined Tiffany Korea ₩2.4 billion (about US$1.6M) in February 2026 over a breach of 4,600 people. Korean law fines the security failure itself, not only misuse of the data.
Check the other services you use →
Sources
- 当社持株会管理システムへの不正アクセスによる個人情報の漏えいについて (Personal data leak caused by unauthorized access to our stock ownership plan administration system) · SMBC Nikko Securities (in Japanese) · official
- SMBC日興証券 最大で5万6000人余りの個人情報漏えいか 持ち株会管理システムに不正アクセス · TBS NEWS DIG (in Japanese) · news