Summary
- Environment: Production and training trade-document environments
- Operational impact: Production and training suspended; restart date unresolved
- Financial impact: No confirmed incident cost quantified
- Record status: Developing record. Reviewed November 12, 2026; updated as evidence emerges.
What happened
TradeWaltz detected unauthorized access November 10, 2026. It traced entry to misuse of a system-management key stored on an attacked server operated by an unnamed contractor. [1]
Impact
By November 12, the company had identified 130 leaked trade documents, including names and initials. This is a document count, not a count of affected people. Production and training remained suspended; Grain Importers and Export Documentary services were outside the incident’s scope. [1]
Timeline
Intrusion detected; environments stopped
Detection was around 10:00 JST; shutdown followed at 14:30.
[1]Leakage and key misuse confirmed
Investigators confirmed document theft and traced the compromised key to the contractor’s server.
[1]Scope identified; customers notified
The ninth report identified 130 documents and completed customer notices.
[1]Briefing updated
This briefing was last reviewed and updated on November 12, 2026.
Threat Group & Attack Vector
The contractor was not affiliated through ownership. Its identity and the method used to compromise its server were not disclosed. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1078 — Valid Accounts: the attacker misused a system-management access key. [1]
Response
TradeWaltz removed abused and attacker-created accounts, restricted source IPs and submitted a preliminary privacy-regulator report. Restart through November 13 was described as difficult; no firm date was established. [1]