IwaiCosmo Securities Cyberattack Triggers Unauthorized Trades in Seven Accounts

Osaka-based brokerage IwaiCosmo Securities Co. Announced on October 20 that a cyberattack on its online trading system allowed unauthorized trades in customer accounts and exposed the personal data of 4,975 people. The company said unauthorized orders were placed in seven customer accounts, with trades executed in five. EIN Presswire carried the announcement.

How the IwaiCosmo Securities Breach Unfolded

IwaiCosmo Securities and Tokyo-based Trade Works Co., which operates and maintains the system, disclosed the incident. An investigation found that personal information on 4,975 people, including names and email addresses, had been exposed. The company said it had contacted affected customers and restored the accounts to their pre-trade status, leaving them with no losses.

Trade Works said it detected the attack on October 14 and immediately imposed access restrictions. The company said the trades were unrelated to the leaked data and that no online trading passwords or other credentials appeared to have been compromised. The system remains in operation after security measures were strengthened to block unauthorized communications.

"While continuing monitoring and inspections, we are working to determine the cause and prevent a recurrence," said a corporate planning official.

Cybersecurity expert Masakatsu Morii, professor emeritus at Kobe University, said the incident appeared to be unlike typical data breaches. "I have never heard of a case like this in Japan. It is an attack on a completely different level from the leakage of personal information," Morii said. He said he was not aware of previous cases in Japan in which attackers infiltrated a financial institution's system and manipulated transactions.

Rankiteo Blog reported that the breach exposed sensitive client information and that affected accounts were later restored. Trade Works, which also provides online trading services for other financial institutions, said no similar incidents had been detected among its other clients as of October 20.

Other Data Incidents at Klein ISD, VMware and Kaspersky

Nearly 38,000 Klein ISD employees may have had their personal information exposed in a data breach targeting a third-party software provider, Yahoo reported on October 20. The exposed data includes Social Security numbers, driver's license numbers, and home addresses, and the software company will offer two years of free credit monitoring to affected individuals.

Rankiteo Blog reported that a ransomware attack by BlackMamba struck critical infrastructure in Germany, France, and the Netherlands on June 12, 2024, exploiting a zero-day flaw in VMware ESXi hypervisors, with at least 15 organizations affected.

TechRadar reported that Kaspersky's VPN, password manager, Safe Kids, and My Kaspersky portal went dark worldwide from October 11 to 14, affecting users on four continents.

What Comes Next for IwaiCosmo Securities

IwaiCosmo Securities said it is continuing monitoring and inspections while working to determine the cause and prevent a recurrence. Trade Works said no similar incidents had been detected among its other clients as of October 20.