> JapanHacked_
[Contained][Severity: Major][Credential abuse]

FWD Life: unauthorized agency login puts up to 9,000 insurance contract records at risk

FWD detected unauthorized use of an agency salesperson’s FWD navi account on 7 November. Up to 9,000 contract records, including policyholder/insured names, may have leaked.

Disclosed

2026-11-09

Organizations involved

1

Leaked or at risk

9K

9,000

Downtime

Unknown

Contract-data access and containment

On 7 November, FWD found that an outsider had used an agency salesperson’s account to log into FWD navi and could view contract data. As of 19:00 on 9 November, it judged up to 9,000 contract records, including policyholder and insured names, potentially exposed. This is a record count, not a person count. Card-number and My Number exposure is not confirmed. [1]

The account and internet access to the system were suspended. FWD checked that potentially affected contracts had no unauthorized changes and completed preventive measures. It reports no impact on coverage, premium payments or claims payments, and plans individual written notification and authority reporting. The notice does not establish health-data exposure or how the account credentials were obtained. [1]

Timeline

  1. Detected 2026-11-07
  2. Disclosed 2026-11-09
  3. 2 days

Attack or cause

Method
[Credential abuse]
Impact
[Data leak][Service outage]
Entry point
Web app

Data exposed or at risk

[Name]

Services hit

Organizations involved

Sources

  1. [1][Official]代理店向けシステムへの不正アクセスに伴うお客さま情報の漏えいについてFWD Life Insurance Company, Limited · 2026-11-09