From our other sites
The story
On October 20, Iwai Cosmo Securities and Trade Works, the firm that operates and maintains its systems, revealed that the company’s online trading system had been hit by a cyberattack, resulting in buy and sell orders that customers never intended to place. According to a report by the Asahi Shimbun, no leak of authentication data such as PINs has been confirmed, raising the possibility that attackers found a route to place orders without using login credentials at all. On the forum thread, opinions were all over the map on causes and countermeasures — whether passkeys had been rolled out, how lax security practices might have been, AI-automated attacks, and the risk of this spreading to banking or pension systems.
Tue, Oct 20, 10:21 PM
Asahi Shimbun
The online trading system of Iwai Cosmo Securities (Osaka) was hit by a cyberattack, resulting in trades customers never intended to make. The company and Trade Works (Tokyo), which handles the system’s operation and maintenance, disclosed this on the 20th.
Source: topics.smt.docomo.ne.jp / Read the original article here
What people said
As a consumer, the surest move is to boycott profit-first companies that treat security as just a cost to minimize.
Just go full self-isolation (sakoku, Japan's old 'closed country' policy) solo — problem solved.
Some companies do get as far as adding passkeys, but it's pointless unless they also disable the password afterward — or set it to a random string so long even they couldn't remember it, print it out, and wipe the digital copy.
Wasn't there a Korean bank that got hit the same way?
> and no leak of PINs or other credentials needed for online trading has been confirmed.
So basically, there was a hole that let attackers skip authentication entirely — no ID, no password — and place orders straight from the account…
LOL, so unauthorized access is possible without even logging in?
Apparently most banks don't actually expose account data directly to the internet, though.
Then pensions and the stock market are next too, right? That's capitalism done for.
As long as balances are recorded on a computer, tampering with them isn't impossible, no.
Well, AI isn't totally unrelated — thanks to AI, attackers can hit targets indiscriminately with way less effort, and that's exactly what's exposing the companies slacking on security.
Those garbage companies really should just go under, but somehow they'll end up getting bailed out 'for the sake of society'… with our tax money 🤣
They're also pushing to link everything to your My Number (Japan's national ID system). If that gets compromised, your money would vanish in an instant.
Can't — someone else will just trade it on your behalf without asking.
Everyone already bought in ages ago. It's on an absolute tear right now lol
Even the Pentagon, with supposedly world-class defenses, gets breached — offense just has the upper hand.
The defense side can learn autonomously too, but it tends to only learn after being attacked, which puts it at a disadvantage. Worst case, an AI testing itself during autonomous learning could end up attacking other systems.
Even if what leaks from any single company isn't a big deal on its own, if the same hacker is pulling data from multiple sources, cross-referencing it by name could add up to something serious. Even just registering your name and email for a '5% off this purchase if you sign up' deal — stack enough of that kind of data and you can start guessing everything from someone's preferences to their income.
Even if the system offers it, there are probably users who never actually turn it on, right?
Most places have rolled out passkeys, but password login still works alongside it. Smart Securities is apparently killing password login entirely this month, though.
Like that incident a while back — probably someone noticed a trade executed for Chinese market stocks they'd never buy.
Apparently they detected the attack and cut off access.
Background and Key Points of the Discussion
Unauthorized access targeting brokerages’ online trading systems — resulting in stock trades customers never intended — has been reported at multiple firms since 2025, and some in the thread pointed to past cases of this kind. What Iwai Cosmo Securities emphasized this time is that authentication data such as PINs was not itself leaked, suggesting attackers may have used a different route than the conventional method of stealing IDs and passwords to impersonate users. Opinions in the thread split over whether the main driver behind this rise in attacks is AI-automated hacking or simply insufficient security investment by companies. There were also comments noting that even financial institutions that have adopted passkeys (passwordless authentication via biometrics, etc.) often keep the older password login running in parallel, meaning vulnerabilities can persist unless one method or the other is fully disabled. Note: posts containing ethnic slurs or incitement to violence toward any nationality have been excluded from this article.
*This article is excerpted and summarized from the 5ch (News Express+) thread: “[Unauthorized Trading] Cyberattack Hits Iwai Cosmo Securities — Client-Unintended Trade Orders Executed“
Leave a Reply