Rakuten Securities may have leaked data on 362 customer records; unauthorized access hit NTT Data subcontractor

What happened

On October 31, Rakuten Securities said that information on up to 362 customer records may have leaked. The customers had bought certain 'digital-perk corporate bonds' (bonds that come with online benefits). A system provided by a subcontractor of NTT Data was accessed by an outsider without permission. Rakuten Securities has not said which types of information may have been exposed.

Key numbers and facts

• Up to 362 customer records may have leaked.
• Three bond issues are affected: Kagome, West Japan Railway, and Kintetsu Group Holdings.
• The break-in happened on October 30, 2026. NTT Data reported it to Rakuten Securities.
• Only buyers of the Kintetsu bond who bought 1 million yen or more are affected.
• NTT Data has stopped its 'STdirectServices' benefit service for bond buyers.

Some background

Companies often use outside firms to run parts of their systems. When an outside firm is hacked, the company that hired it can also be affected. Rakuten Securities says the leaked data does not include login IDs, passwords, or the information needed to make trades.

Why it matters

Banks and brokerages hold a lot of private customer data, so customers need to trust that it is safe. This case shows that a weak point at a partner company can put a main company's customers at risk. Customers may also worry about scams that use their data.

What to watch

• Which types of customer information were leaked.
• What the subcontractor finds about how the attackers got in.
• Whether affected customers are contacted one by one, as the companies have promised.
• When NTT Data's benefit service will start again.