---
title: "TradeWaltz trade-document theft"
description: "TradeWaltz confirmed theft of 130 trade documents after misuse of a management key held by a contractor."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-12"
canonical_url: "https://www.ally.security/incidents/tradewaltz-trade-document-theft-2026"
markdown_url: "https://www.ally.security/incidents/tradewaltz-trade-document-theft-2026.md"
stix_url: "https://www.ally.security/incidents/tradewaltz-trade-document-theft-2026/stix.json"
---

# TradeWaltz trade-document theft

TradeWaltz confirmed theft of 130 trade documents after misuse of a management key held by a contractor.

Last modified Nov 12, 2026 · 1 source

## Summary

- **Environment:** Production and training trade-document environments
- **Operational impact:** Production and training suspended; restart date unresolved
- **Financial impact:** No confirmed incident cost quantified

## What happened

[TradeWaltz](https://www.tradewaltz.com/) detected unauthorized access November 10, 2026. It traced entry to misuse of a system-management key stored on an attacked server operated by an unnamed contractor. [1](#source-1)

## Impact

By November 12, the company had identified **130 leaked trade documents**, including names and initials. This is a document count, not a count of affected people. Production and training remained suspended; Grain Importers and Export Documentary services were outside the incident’s scope. [1](#source-1)

## Timeline

### November 10, 2026 — Intrusion detected; environments stopped

Detection was around 10:00 JST; shutdown followed at 14:30. [1](#source-1)

### November 11, 2026 — Leakage and key misuse confirmed

Investigators confirmed document theft and traced the compromised key to the contractor’s server. [1](#source-1)

### November 12, 2026 — Scope identified; customers notified

The [ninth report](https://www.tradewaltz.com/news/13816/) identified 130 documents and completed customer notices. [1](#source-1)

### November 12, 2026 — Briefing updated

This briefing was last reviewed and updated on November 12, 2026.

## Threat Group & Attack Vector

The contractor was not affiliated through ownership. Its identity and the method used to compromise its server were not disclosed. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- [T1078 — Valid Accounts](https://attack.mitre.org/techniques/T1078/): the attacker misused a system-management access key. [1](#source-1)

## Response

TradeWaltz removed abused and attacker-created accounts, restricted source IPs and submitted a preliminary privacy-regulator report. Restart through November 13 was described as difficult; no firm date was established. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/tradewaltz-trade-document-theft-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### TradeWaltz intrusion and service-suspension updates

official · TradeWaltz · Nov 10, 2026

<https://www.tradewaltz.com/news/13816/>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Affected Organization · 100% confidence · current**  
   TradeWaltz trade-document theft: TradeWaltz
2. **Resulted In · 100% confidence · current**  
   TradeWaltz trade-document theft: TradeWaltz traced unauthorized access to misuse of its system-management access key stored on an attacked server operated by an unnamed, non-affiliated contractor.
3. **Resulted In · 100% confidence · current**  
   TradeWaltz trade-document theft: 130-document scope identified and customers notified
4. **Resulted In · 100% confidence · current**  
   TradeWaltz trade-document theft: Intrusion detected and environments stopped
5. **Resulted In · 100% confidence · current**  
   TradeWaltz trade-document theft: By November 12 16:55 JST the leakage scope was identified as 130 trade documents, including personal names and initials. Affected customers had been contacted by12:00 and a preliminary privacy-regulator report submitted.
6. **Occurred At · 100% confidence · current**  
   Intrusion detected and environments stopped: 2026-11-10
7. **Occurred At · 100% confidence · current**  
   Document leakage and contractor-key misuse confirmed: 2026-11-11
8. **Disclosed At · 100% confidence · current**  
   TradeWaltz trade-document theft: 2026-11-10
9. **Resulted In · 100% confidence · current**  
   TradeWaltz trade-document theft: After detection around 10:00 November 10, production and training environments stopped at 14:30 JST. Abused and attacker-created accounts were removed at 14:45 and source-IP restrictions applied at 14:55. Grain Importers and Export Documentary services were excluded.
10. **Resulted In · 100% confidence · current**  
   TradeWaltz trade-document theft: Document leakage and contractor-key misuse confirmed
11. **Resulted In · 100% confidence · current**  
   TradeWaltz trade-document theft: The November 12 report said service resumption through November 13 was difficult; a subsequent announcement would address November 14 onward. No firm restart date was established.
12. **Occurred At · 100% confidence · current**  
   130-document scope identified and customers notified: 2026-11-12
13. **Used Attack Technique · 100% confidence · current**  
   TradeWaltz trade-document theft: https://attack.mitre.org/techniques/T1078/
14. **Discovered At · 100% confidence · current**  
   TradeWaltz trade-document theft: 2026-11-10

</details>