Green Monster Inc. disclosed a cyberattack on FX Navi, its foreign-exchange demo trading app, and reported that approximately 6.19 million items of user information and other data may have been obtained by a third party. An investigation conducted from 17 October onward identified the possibility that information had been obtained from a different IP address.
Green Monster Inc. disclosed on 23 October 2026 that FX Navi, its foreign-exchange demo trading app, had been subject to a cyberattack. The affected data may include approximately 6.19 million items of user information, including some email addresses. As of the time of the disclosure, leakage of all the information had not been confirmed, and the affected data may also include data other than personal information.
The disclosed breakdown included 66,003 email addresses, 4,809,631 initial survey responses and 5,120 transfer codes. Names, addresses, telephone numbers, dates of birth, card information, bank account information and My Number were not included among the affected data items.
The company explained that the cause was related to the app's API functionality. It modified the problematic API functionality and comprehensively invalidated the login credentials issued before the modification.
The company plans to disclose details of measures to prevent a recurrence. As of the time of the disclosure, it had not confirmed that any fraudulently obtained information had been published or that any secondary harm had occurred.
FX Navi is a demo trading app, and the incident does not indicate damage to real accounts. However, the information that may have been obtained includes survey responses indicating users' investment interests and demo trading results, raising the risk of misuse for solicitation and other purposes.