Breaches and incidents
Trade Works / IwaiCosmo Securities: online trading system admin function abused, 4,975 customers’ data leaked and unauthorized orders placed
Trade Works said that on 14 Oct a third party abused the internet trading system it provides to IwaiCosmo Securities, leaking names, emails and other data.
- Disclosed
- Verification
- Checked against a primary source
What happened
- Trade Works said that on 14 Oct a third party abused the internet trading system it provides to IwaiCosmo Securities, leaking names, emails and other data; IwaiCosmo’s 20 Oct second report raised the count to 4,975 and disclosed that unintended orders were placed in 7 accounts, 5 of them executed.
- Root cause per Trade Works: “a configuration flaw in some administrative functions” of its system was exploited; customer logins had MFA and passkeys, and no password theft was confirmed.
- No attacker named.
- The function was disabled, connections cut, trades reversed with no cost to customers, and other financial-institution clients checked with no similar access found; Trade Works will bear losses and expects cyber insurance to apply.