SMBC Nikko Securities announced on 11 November that the stock-ownership-association management system it uses for outsourced plan administration was accessed by a third party, and personal data of some members was confirmed leaked [1]. Data that leaked or may have leaked includes the association name, investment holdings, member ID, name, address, dividends and taxes, holding balances and transfer-account details for up to 56,487 members, excluding phone numbers and email addresses [1]. The company is contacting the affected associations individually and asks members to be cautious of unexpected contacts that claim to be from SMBC Nikko [1].
HighMonitoringOfficially confirmed
SMBC Nikko employee stock ownership plan system breached; addresses and bank transfer details of up to 56,000 members leaked
1 min read
- Disclosed
- Nov 11, 2026
- Occurred
- Nov 9, 2026
- Published
- Nov 12, 2026
- Last updated
- Nov 12, 2026
- Scale
- 56,487 people[2]
- CVSS basis
- Our assessment
- Attack vector
- Impact
- Data type
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Finance
What to do nowOur advice
- Be cautious of unexpected contacts that claim to be from SMBC Nikko [1].
Timeline
Technical details
Remediation
Vendor guidance
- 1Beware of impersonation mitigate[1]
Do not respond to suspicious contacts claiming to be SMBC Nikko or give account or password details.
References
Official / primary1
- [2]ＳＭＢＣ日興証券株式会社2026-11-11Accessed 2026-11-12Snapshot 2026-11-12 sha256 d19bfbaa84af
“持株会の会員さまの個人情報が漏えいしたことを確認いたしました。”
Media1
- [1]
Corrections
- · references: 2. https://www.smbcnikko.co.jp/news/release/2026/pdf/261111_01.pdf → Official PDF capture still fails tiny_body: all streams are written as >>stream with no whitespace before the stream keyword, so the extractor skips them even after empty-password RC4 decrypt. Leaving an unarchived official ref on a published advisory would re-block the publish gate.
- · references: 2. https://www.smbcnikko.co.jp/news/release/2026/pdf/261111_01.pdf → 官方 PDF 第一方封存仍失敗，刪除未封存來源以免 published 項目留下 reference_not_archived
- · confirmation_status: media_reported → official_confirmed官方公告 PDF 已第一方封存，改以該公告引用外洩範圍與專用窗口，並將確認狀態回復為 official_confirmed
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.