Japanese financial technology provider Trade Works has acknowledged that shortcomings in its system design and operational management contributed to an October cyberattack affecting brokerage client Iwai Cosmo Securities, in which attackers placed unauthorised stock trades in customer accounts and personal data belonging to 4,975 customers may have leaked. The company has tightened security across systems it supplies to other financial institutions, as Japan's government pushes for stronger safeguards and oversight of external service providers.

The attack is believed to be the first case in Japan's financial industry in which unauthorised trades were executed through a vendor's systems, and it has become a test case for third-party risk in the country's securities sector.

Orders placed without logging in as customers

On 14 October, attackers placed buy and sell orders in seven customer accounts at Iwai Cosmo Securities, a mid-sized Osaka brokerage. Orders in five accounts were executed. The firm reversed them the same day, and customers bore no loss.

The attackers did not log in as the customers. Iwai Cosmo had made multi-factor authentication mandatory in 2025. Instead, they went through Trade Works, the vendor that runs its online trading system, by exploiting a misconfigured administrative function and attacking the trade management system behind it. A configuration flaw had left an admin function, meant to be used only from a restricted environment, reachable from outside.

Names and email addresses of 4,975 customers also leaked. Iwai Cosmo first disclosed only the leak, on 16 October, when 4,611 customers were thought to be affected, and revealed the trades on 20 October, saying it had held back details until countermeasures were in place. A further 364 customers were added to the total in the second report. The leaked data does not include trading PINs, and cannot be used to log in or trade.

Regulator steps in as vendor counts the cost

On 21 October, Chief Cabinet Secretary Minoru Kihara said the Financial Services Agency had asked Iwai Cosmo to analyse the cause and prepare measures to prevent a recurrence. Trade Works' third report, published on 2 November, restated the cause and put the expected loss at about 50 million yen, though the figure is not yet final.

Trade Works said it had fixed the cause, restricted access to its admin functions, strengthened blocking of malicious traffic, added immediate detection of login anomalies and increased monitoring. It found no similar incident at the other financial institutions it serves, but said attack traffic was still arriving and being blocked, and that it was cooperating with police.

The episode sits inside a wider wave of attacks on Japan's securities firms, and inside a broader reckoning over outsourcing. When a brokerage hands its trading platform to a vendor, the vendor's configuration becomes the brokerage's security boundary, and a single misconfigured admin function can put customer accounts and customer data at risk at once. Japan's government compiled an emergency cybersecurity package on 6 November, and police have opened a nationwide joint investigation into the year's large breaches. For other firms that rely on the same model, the Iwai Cosmo case is now the warning example.