SBI Securities: intruders got into 6 customer accounts, sold their securities and withdrew 98.64 million yen to fake bank accounts

From July to September, someone used customers' login names, passwords and trading passwords to sell their securities several times and withdraw the money. Unauthorized login attempts had been rising in the same period. [1]

1. 2020-09-07

   Monitoring spotted suspicious access. When the company asked, a customer reported trades they had not made. [1]

2. 2020-09-16

   Public disclosure. A log review confirmed losses in 6 accounts. [1]

A total of 98.64 million yen was withdrawn from 6 accounts: 92.29 million yen to 5 Japan Post Bank accounts and 6.35 million yen to 1 MUFG Bank account. Withdrawals had to go to an account in the customer's own name, so fake accounts had been opened with forged ID documents. Almost nothing was left in them. [1]

SBI Securities denied any leak from its own systems and pointed to phishing or password list attacks as possible causes. Because the trading password must differ from the login password, how it was obtained was seen as the key question. [1]

The company said it would repay the victims. It stopped changes to withdrawal accounts on the website, allowing them by mail only, strengthened monitoring and access limits, and planned two-factor authentication with one-time passwords. [1]