Teollimi

SMBC Nikko Securities data breach

SMBC Nikko Securities announced a data breach on Nov 11, 2026 affecting about 56,487 people, exposing names, addresses and bank or financial details. It was caused by a cyberattack. No settlement or compensation has been announced.

Was I affected?

You may be affected if you belong to an employee stock ownership plan (mochikabukai) that your employer has SMBC Nikko administer; the company is contacting the affected plans individually.

SMBC Nikko Securities breach facts
AnnouncedNov 11, 2026
When it happenedUnauthorized access detected November 9, 2026
CountryJapan
People affected56,487
Data exposedNames, Addresses, Bank or financial details and Other details
StatusConfirmed by the company or a regulator filing

What happened

SMBC Nikko Securities, one of Japan's largest brokerages, said on November 11, 2026 that an outsider broke into the system it uses to administer employee stock ownership plans for client companies, and that plan members' personal data leaked from it. It detected the access on November 9, cut off the system and suspended the service the same day. Up to 56,487 plan members are involved; the data that may have leaked includes the plan name, investment holdings, member ID number, name, address, dividends and taxes, holding balance and the bank account used for transfers, varying by member. Phone numbers and email addresses are not stored in the system, and the company says no secondary damage has been confirmed.

What should I do?

  1. Be wary of letters, calls or messages claiming to be from SMBC Nikko or your stock ownership plan, and check with the dedicated helpline (0120-715-250) or your employer's plan office before acting.
  2. Watch the bank account linked to your plan for transfers or withdrawals you don't recognize.
  3. Don't give passwords, PINs or one-time codes to anyone who contacts you about your plan holdings or dividends.
  4. Be suspicious of investment pitches that mention your shareholdings, since holdings and address data may be in the leak.

How Korea fines a breach this size

For comparison, Korea's privacy regulator fined Tiffany Korea ₩2.4 billion (about US$1.6M) in February 2026 over a breach of 4,600 people. Korean law fines the security failure itself, not only misuse of the data.

Data breach fines: Korea vs Japan, the US and Australia →

Know someone who uses SMBC Nikko Securities? Share this

More data breaches in Japan →

Check the other services you use →

Sources