Summary
- Environment: Internet trading system operated and maintained by Trade Works
- Operational impact: Unauthorized orders in seven accounts; executions in five
- Financial impact: Trade Works estimated JPY 50 million in losses; amount not final
- Record status: Developing record. Reviewed October 23, 2026; updated as evidence emerges.
What happened
IwaiCosmo Securities detected unauthorized access to its Trade Works trading system on October 14, 2026. [4] Attackers placed orders in seven accounts, with executions in five. [3]
Impact
The October 20 notice revised the affected population from 4,611 to 4,975 after further log review. It described the same intrusion, not another breach. Names and email addresses were among the leaked fields; trading PINs were excluded. [3]
Trade Works estimated losses of about JPY 50 million, with the amount and insurance coverage still under review. [1]
Timeline
Access detected and blocked
IwaiCosmo contacted its provider and imposed emergency restrictions.
[4]Initial disclosure
The first notice reported 4,611 affected customers.
[4]Count and trading impact clarified
The second notice added 364 people and disclosed unauthorized orders.
[3]Vendor quantified expected losses
The vendor explained the configuration defect and provisional loss estimate.
[1]Briefing updated
This briefing was last reviewed and updated on October 23, 2026.
Threat Group & Attack Vector
Trade Works said a configuration defect made a restricted management function externally accessible. Attackers used it to conduct trades. [1] IwaiCosmo described a system weakness and brute-force activity, while stating that passkeys were not defeated and leaked personal information did not enable the trades. The precise brute-force target remains unspecified. [2][3]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.