--- title: "IwaiCosmo TradeWorks trading-system compromise" description: "IwaiCosmo reported 4,975 affected customers and unauthorized trades through a TradeWorks management function." incident_type: "Data incident" status: "active" last_modified: "2026-10-23" canonical_url: "https://www.ally.security/incidents/iwaicosmo-tradeworks-trading-system-compromise-2026" markdown_url: "https://www.ally.security/incidents/iwaicosmo-tradeworks-trading-system-compromise-2026.md" stix_url: "https://www.ally.security/incidents/iwaicosmo-tradeworks-trading-system-compromise-2026/stix.json" --- # IwaiCosmo TradeWorks trading-system compromise A vendor system compromise exposed customer information and enabled unauthorized orders in seven accounts. Last modified Oct 23, 2026 · 4 sources ## Summary - **Environment:** Internet trading system operated and maintained by Trade Works - **Operational impact:** Unauthorized orders in seven accounts; executions in five - **Financial impact:** Trade Works estimated JPY 50 million in losses; amount not final ## What happened [IwaiCosmo Securities](https://www.iwaicosmo.co.jp/) detected unauthorized access to its [Trade Works](https://www.tworks.co.jp/) trading system on October 14, 2026. [4](#source-4) Attackers placed orders in seven accounts, with executions in five. [3](#source-3) ## Impact The [October 20 notice](https://www.iwaicosmo.co.jp/info/2026/10201710.html) revised the affected population from 4,611 to 4,975 after further log review. It described the same intrusion, not another breach. Names and email addresses were among the leaked fields; trading PINs were excluded. [3](#source-3) Trade Works [estimated losses of about JPY 50 million](https://pdf.irpocket.com/C3997/xoA3/f6yw/gbHS/GiVN.pdf), with the amount and insurance coverage still under review. [1](#source-1) ## Timeline ### October 14, 2026 — Access detected and blocked IwaiCosmo contacted its provider and imposed emergency restrictions. [4](#source-4) ### October 16, 2026 — Initial disclosure The [first notice](https://www.iwaicosmo-hd.jp/news/pdf/discl20261016-2.pdf) reported 4,611 affected customers. [4](#source-4) ### October 20, 2026 — Count and trading impact clarified The second notice added 364 people and disclosed unauthorized orders. [3](#source-3) ### October 23, 2026 — Vendor quantified expected losses The vendor explained the configuration defect and provisional loss estimate. [1](#source-1) ### October 23, 2026 — Briefing updated This briefing was last reviewed and updated on October 23, 2026. ## Threat Group & Attack Vector Trade Works said a configuration defect made a restricted management function externally accessible. Attackers used it to conduct trades. [1](#source-1) IwaiCosmo described a system weakness and brute-force activity, while stating that passkeys were not defeated and leaked personal information did not enable the trades. The precise brute-force target remains unspecified. [2](#source-2) [3](#source-3) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response IwaiCosmo restored affected accounts without customer financial burden. [3](#source-3) Trade Works permanently restricted the exposed function and strengthened connection controls, detection and monitoring. It reported no further intrusion or unauthorized trades after containment. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### （開示事項の経過）当社が提供するシステムへの不正アクセスに関するお知らせ official · Trade Works · Oct 23, 2026 ### 不正アクセスによる個人情報漏洩および不正取引に関するご報告 official · IwaiCosmo Securities · Oct 21, 2026 ### 外部委託先への不正アクセスに伴うお客様情報の漏洩について(第2報) official · IwaiCosmo Securities · Oct 20, 2026 ### 外部委託先への不正アクセスに伴うお客様情報の漏洩について official · IwaiCosmo Securities · Oct 16, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** IwaiCosmo TradeWorks trading-system compromise: Trade Works said no further intrusion or unauthorized trades had occurred after October 14 containment, and no comparable event had been confirmed in its other financial-institution systems. 2. **Occurred At · 100% confidence · current** Unauthorized access detected and blocked: 2026-10-14 3. **Affected Individual Count · 100% confidence · current** IwaiCosmo TradeWorks trading-system compromise: 4,975 4. **Occurred At · 100% confidence · current** Initial leak notice published: 2026-10-16 5. **Affected Organization · 100% confidence · current** IwaiCosmo TradeWorks trading-system compromise: Trade Works Co., Ltd. 6. **Resulted In · 100% confidence · current** IwaiCosmo TradeWorks trading-system compromise: Trade Works permanently restricted the management function, strengthened connection restrictions and detection, and expanded monitoring. 7. **Resulted In · 100% confidence · current** IwaiCosmo TradeWorks trading-system compromise: Initial leak notice published 8. **Resulted In · 100% confidence · current** IwaiCosmo TradeWorks trading-system compromise: On October 14, unauthorized orders affected seven accounts and executed in five; IwaiCosmo said the trades did not use the leaked personal information. 9. **Resulted In · 100% confidence · current** IwaiCosmo TradeWorks trading-system compromise: IwaiCosmo reported leaked names and email addresses, among other fields, excluding trading PINs. 10. **Resulted In · 100% confidence · current** IwaiCosmo TradeWorks trading-system compromise: IwaiCosmo said affected accounts were restored to their pre-trade state without customer financial burden. 11. **Vendor Of · 100% confidence · current** Trade Works Co., Ltd.: IwaiCosmo Securities 12. **Occurred At · 100% confidence · current** Count revised and unauthorized trades disclosed: 2026-10-20 13. **Resulted In · 100% confidence · current** IwaiCosmo TradeWorks trading-system compromise: Trade Works estimated about JPY 50 million in losses for a fourth-quarter extraordinary charge; the amount and insurance coverage remained under review. 14. **Resulted In · 100% confidence · current** IwaiCosmo TradeWorks trading-system compromise: Trade Works said a configuration defect exposed a management function externally when it should have been restricted; attackers used that function for unauthorized trades. 15. **Disclosed At · 100% confidence · current** IwaiCosmo TradeWorks trading-system compromise: 2026-10-16 16. **Affected Organization · 100% confidence · current** IwaiCosmo TradeWorks trading-system compromise: IwaiCosmo Securities 17. **Discovered At · 100% confidence · current** IwaiCosmo TradeWorks trading-system compromise: 2026-10-14 18. **Occurred At · 100% confidence · current** Vendor estimated losses and explained configuration defect: 2026-10-23 19. **Resulted In · 100% confidence · current** IwaiCosmo TradeWorks trading-system compromise: A log recheck added 364 people to the initial 4,611, bringing the affected population to 4,975; IwaiCosmo said this was the same access, not another intrusion. 20. **Resulted In · 100% confidence · current** IwaiCosmo TradeWorks trading-system compromise: Vendor estimated losses and explained configuration defect 21. **Resulted In · 100% confidence · current** IwaiCosmo TradeWorks trading-system compromise: IwaiCosmo described exploitation of a system weakness and a brute-force attack, and said passkey authentication was not defeated. 22. **Resulted In · 100% confidence · current** IwaiCosmo TradeWorks trading-system compromise: Unauthorized access detected and blocked 23. **Resulted In · 100% confidence · current** IwaiCosmo TradeWorks trading-system compromise: Count revised and unauthorized trades disclosed