Unauthorized access to a system provided by the Company
TRADE WORKS Co.,Ltd
Internet trading system provided to Iwai Cosmo Securities Co., Ltd.
Configuration deficiencies in certain administrative functions of the system provided to the company caused functions intended to be available only from a restricted environment to become accessible externally. Design and operational controls were inadequate.
Approximately ¥50 million (not a finalized amount; expected loss)
The impact on financial results is currently under review, and the full-year consolidated earnings forecast has not been revised at this time. The company will promptly disclose any matters that should be disclosed once identified.
Related procedures
Cooperation with police investigations, and cooperation with reports to and explanations for the relevant authorities
Relevant authorities, the police, the Financial Services Agency, and the Bank of Japan
Company response
No establishment of a third-party committee or special investigation committee is stated. A response headquarters was established, and an assessment was conducted by the company's specialist departments.
Verify and manage every access request each time, regardless of whether it originates internally or externally; protect privileged functions such as administrative functions with multi-factor authentication and the minimum necessary permissions; continuously manage assets reachable from outside; set deadlines from vulnerability assessment through remediation; ensure security from the planning and design stages (security by design); detect early warning signs through behavioral monitoring; establish containment and recovery procedures and conduct joint training with service recipients; preserve operation logs in an immutable format; integrate and strengthen internal organizations related to risk management; roll out standardized operating procedures for monitoring and reporting criteria; standardize security levels and strengthen monitoring
The company will continue inspecting and strengthening systems for the company and other financial institutions, as well as monitoring and defense. It will cooperate with reports to and explanations for the relevant authorities and implement measures to prevent recurrence based on issues that come to light.
The company will promptly disclose any new matters that arise and should be communicated.
| Item | Details |
|---|---|
| Event name | Unauthorized access to a system provided by the Company |
| Subject Entity | TRADE WORKS Co.,Ltd |
| Target Locations / Products | Internet trading system provided to Iwai Cosmo Securities Co., Ltd. |
| Cause | Configuration deficiencies in certain administrative functions of the system provided to the company caused functions intended to be available only from a restricted environment to become accessible externally. Design and operational controls were inadequate. |
| Amount of Impact on Business Performance | Approximately ¥50 million (not a finalized amount; expected loss) |
| Impact on Earnings Forecast | The impact on financial results is currently under review, and the full-year consolidated earnings forecast has not been revised at this time. The company will promptly disclose any matters that should be disclosed once identified. |
| Type of litigation or proceeding | Cooperation with police investigations, and cooperation with reports to and explanations for the relevant authorities |
| Court or authority | Relevant authorities, the police, the Financial Services Agency, and the Bank of Japan |
| Investigation structure | No establishment of a third-party committee or special investigation committee is stated. A response headquarters was established, and an assessment was conducted by the company's specialist departments. |
| Measures to prevent recurrence | Verify and manage every access request each time, regardless of whether it originates internally or externally; protect privileged functions such as administrative functions with multi-factor authentication and the minimum necessary permissions; continuously manage assets reachable from outside; set deadlines from vulnerability assessment through remediation; ensure security from the planning and design stages (security by design); detect early warning signs through behavioral monitoring; establish containment and recovery procedures and conduct joint training with service recipients; preserve operation logs in an immutable format; integrate and strengthen internal organizations related to risk management; roll out standardized operating procedures for monitoring and reporting criteria; standardize security levels and strengthen monitoring |
| Outlook | The company will continue inspecting and strengthening systems for the company and other financial institutions, as well as monitoring and defense. It will cooperate with reports to and explanations for the relevant authorities and implement measures to prevent recurrence based on issues that come to light. |
| Planned follow-up disclosure | The company will promptly disclose any new matters that arise and should be communicated. |
Items this document does not state (13)
These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.
The reasons the company gives
The company's own explanation, not something inferred from the numbers.Due to configuration deficiencies in certain administrative functions of the system provided to the company, functions intended to be available only from a restricted environment became accessible externally. The company recognizes that its design and operational controls were inadequate.