SMBC Consumer Finance has confirmed that unauthorised access to its loan-guarantee system exposed personal data belonging to up to 320,118 people, in a breach that has rippled across at least 14 Japanese banks. The company, the consumer finance arm of Sumitomo Mitsui Financial Group and operator of the Promise lending brand, announced the incident on 5 November.

Engineers noticed unusual traffic on the guarantee system on Monday 2 November and cut off access the same day. Forensic work on outbound traffic then showed that an outside party had queried the system and sent personal and financial records out of the company. The figure of 320,118 is a maximum, not a confirmed count of victims.

What was exposed

The records held up to fourteen fields: names, gender, dates of birth, addresses, phone numbers, email addresses and twelve-digit Japanese driver's licence numbers, plus employer details, declared annual incomes, guaranteed loan limits and guarantee start dates. Images used for identity checks were not taken, the company said.

Banks caught in the fallout

The exposure came through a central platform SMBC Consumer Finance runs for 189 partner financial institutions, so the partner banks themselves were not breached. Resona Bank, Kansai Mirai Bank, Minato Bank, the Bank of Yokohama and Docomo SMTB Net Bank are among those that have confirmed their customers are affected. Docomo SMTB Net Bank said up to 122,635 of its card-loan customers may be affected. No secondary damage, such as fraud using the stolen data, had been reported when the disclosures were published.

[Source: The CyberSec Guru](https://thecybersecguru.com/news/smbc-consumer-finance-data-breach-2026/) | [Source: Pasquale Pillitteri](https://pasqualepillitteri.it/en/news/30903/smbc-consumer-finance-hacked-resona-bank-of-yokohama)