Following unauthorised access to a digital securities platform operated by an NTT DATA subcontractor, information on purchasers of bonds with digital benefits issued by 3 companies, including Rakuten Securities, may have been exposed. Information on the affected issues and the potential exposure has been disclosed, and further investigation and verification are expected to continue.
On 31 October, Rakuten Securities announced that information on purchasers of bonds with digital benefits may have been exposed in a total of 362 cases. A third party gained unauthorised access to a digital securities platform operated by an NTT DATA subcontractor providing external services, and the information may have been taken outside the platform. No intrusion into Rakuten Securities' own systems has been confirmed.
The potentially affected customers purchased one of 3 issues: Kagome's First Unsecured Corporate Bond, issued on 21 February 2023; JR West's 80th Unsecured Corporate Bond, issued on 19 June 2024; or Kintetsu Group Holdings' 135th Unsecured Corporate Bond, issued on 24 July 2026. Some cases involved customers who purchased ¥1 million or more. IDs, passwords and account information were reportedly not among the data potentially exposed.
On the same day, JR West announced that information on 2 purchasers of its 80th Unsecured Corporate Bond may have been exposed, identifying names, addresses, telephone numbers, email addresses, gender and dates of birth as the affected information. Nomura Securities also indicated that information on some customers who purchased bonds with digital benefits may have been exposed, but said the details remained under investigation and the number of cases had not been disclosed.
NTT DATA announced that it would suspend STdirectServices, but did not disclose the name of the subcontractor. The 3 companies have urged customers to beware of suspicious emails, SMS messages and telephone calls. The incident has again highlighted the importance of supply-chain-wide management frameworks, against a backdrop of companies entrusting peripheral operations to external cloud services as they pursue digitalisation.