SMBC Trust Bank and SMBC Nikko Securities: a permission error in their cloud account-opening systems left data of up to 118,764 people viewable from outside

1. 2020-11-08

   An outside third party viewed data in the SMBC Trust Bank system. [1]

2. 2020-12-03

   An outside third party viewed data in the SMBC Trust Bank system again. [1]

3. 2020-12-24

   An outside third party viewed data in the SMBC Nikko Securities system. [2]

4. 2021-02-08

   SMBC Trust Bank was told late at night by an outside security expert of a possible permission flaw, and confirmed the flaw the next day. [5]

5. 2021-02-11

   SMBC Nikko Securities found the flaw and changed the access permissions at once. [2] [4]

6. 2021-02-12

   SMBC Trust Bank changed the settings so that third parties could no longer access the data. [1] [4]

7. 2021-03-08

   The two firms disclosed the case. [1] [2] [3]

Both firms kept the data entered by people applying for accounts on their websites in a Salesforce cloud service. When they checked after the Financial Services Agency's December 2020 warning they judged the permissions proper, but a review prompted by an outside expert in February 2021 found that data of people who applied before the product was updated in July 2020 was viewable from outside. [3] [4]

In both cases, a technical problem in analyzing the access logs made it impossible to identify the people whose data was viewed. SMBC Trust Bank could not examine the period from July 24, 2017 to January 31, 2018 because the retention period of the logs had passed. Both firms said they had no reports of harm or misuse. [1] [2] [6]