Iwai Cosmo Securities: unauthorized access through management function misconfiguration and market manipulation trades
iwai-cosmo-tradeworks-2026 · Disclosed 2026-10-16
A third party gained unauthorized access by exploiting a misconfiguration in management functions of Iwai Cosmo Securities' contractor TradeWorks. Unauthorized orders occurred in 7 accounts, with trades executed in 5 accounts. The unauthorized trading involved approximately 1.25 million shares across 12 stocks, many of which were thinly traded, suggesting market manipulation intent. Customer information of 4,975 people was viewable but did not include trading PINs. Unauthorized trades were reversed the same day with no monetary burden on customers.
Outcome: Confirmed breach
Entry path and evidence
- Reported fact
A third party gained unauthorized access by exploiting a misconfiguration in some management functions of the system provided by TradeWorks. The unauthorized access was detected on October 14 and promptly blocked.
- Reported fact
Names, email addresses, etc. of 4,975 people were viewable, but trading PINs were not included. Unauthorized orders occurred in 7 accounts with trades executed in 5 accounts. Unauthorized trading involved approximately 1.25 million shares across 12 stocks, many thinly traded.
- Reported fact
Individual contact was made to affected customers on October 14, and measures to restore accounts to their pre-trade state have been completed, with no burden on customers.
[s2]取引前の状態に戻す措置を完了
Timeline
Morning: Employee noticed someone other than customers was conducting trades. Contacted TradeWorks and blocked communications. Individual contact to affected customers and restored accounts. [s2] [s3]
From 15-17th, over 7.3 million 'login challenge' attempts to access customer accounts occurred, all unsuccessful. [s3]
First announcement published. [s1]
Second announcement published. Additional investigation increased leak scope by 364 to 4,975 people. [s2]
Parent company held press conference. Explained scale of unauthorized trading and potential market manipulation intent. [s3]
Reported response
- Reported fact
Identified and corrected the cause of unauthorized access. Implemented connection source restrictions, enhanced unauthorized access detection/blocking, and expanded monitoring systems.
- Reported fact
TradeWorks has cyber insurance and expects it to apply to this incident. Current estimated loss is approximately 50 million yen.
[s1]サイバー保険に加入 / 約 50 百万円
Cause and mitigation hypotheses
Not assessed. Editorial hypotheses have not been added for this incident; this does not establish safety or a confirmed cause.
Evidence relevant to prevention
Operational controls to inspect
Connection source restrictions for management functions were insufficient, allowing external access. Related rules inspect access controls for management functions, authentication, and login attempt monitoring.
Editorial assessment; not a determination of liability. [s1]
Unknowns and AI involvement
The reviewed primary sources do not establish attacker use of AI.
4,975 is the count of customers whose information was viewable, 7 is accounts with unauthorized orders, and 5 is accounts where trades executed. Specific intrusion path, CVEs used, and attacker identification remain unresolved.
Sources
[s1] トレードワークス · Primary source
（開示事項の経過）当社が提供するシステムへの不正アクセスに関するお知らせ ↗Published 2026-10-23 · Reviewed 2026-11-02
[s2] 岩井コスモ証券 · Primary source
外部委託先への不正アクセスに伴うお客様情報の漏洩について(第2報) ↗Published 2026-10-20 · Reviewed 2026-11-02
[s3] 読売新聞 · Secondary
岩井コスモ証券のシステムにサイバー攻撃、不正取引の規模は１２銘柄で１２５万株 ↗Published 2026-10-23 · Reviewed 2026-11-02