Trade Works: unauthorized access leaks IwaiCosmo Securities customer data and places orders

Attackers accessed the systems of Trade Works, which runs and maintains IwaiCosmo Securities' online trading, on 14 October. Names, email addresses and other data of 4,975 customers leaked. An attack on the order management system the same day placed unintended orders in 7 accounts, 5 of which were executed; Iwai Cosmo has reversed them. On October 21 Iwai Cosmo said the attacker got in by brute-forcing a system vulnerability rather than by breaking passkey authentication. Trading PINs did not leak. On October 23 Trade Works said the cause was a misconfigured management function that could be used from outside although it was meant only for a restricted environment, and that it expects a loss of about 50 million yen, to be booked as an extraordinary loss.