Rakuten Securities, SBI Securities and others: accounts were taken over with phishing-stolen credentials, and holdings were sold to buy Chinese stocks

1. 2025-03-25

   Rakuten Securities announced that login IDs, passwords and trading PINs had been taken through phishing, spyware or malware and used for unauthorized trades. It temporarily stopped buy orders for 582 Chinese (Hong Kong) stocks that may have been involved. [1]

2. 2025-04-03

   The Financial Services Agency warned of unauthorized access and trades using information stolen through fake securities company sites and similar means. [2]

3. 2025-04-18

   The Financial Services Agency's tally from February to April 16 showed unauthorized trades at six firms: Rakuten Securities, SBI Securities, Nomura Securities, Monex, SMBC Nikko Securities and Matsui Securities. It counted 3,312 unauthorized accesses and 1,454 unauthorized trades, with about 50.6 billion yen sold and 44.8 billion yen bought. [3]

4. 2025-05-02

   The Japan Securities Dealers Association announced that 10 major and online securities firms had agreed to compensate customers for damage to a certain extent. [4]

5. 2026-01-14

   The Financial Services Agency's summary showed 17,559 unauthorized accesses and 9,752 unauthorized trades in 2025, worth about 739.3 billion yen. [5]

In most cases, holdings in the account were sold and the proceeds used to buy small-cap stocks such as Chinese stocks. There were no cases of money being withdrawn to a third party. The Financial Services Agency said the damage was not limited to particular firms and could happen at any securities company. [2] [3]