- A cyberattack on Securitize Japan exposed customer data held by Sony Bank, NTT Data and Marui Group.
- Sony Bank has halted digital securities trading while it investigates, and Marui said up to 9,086 digital bond applicants were affected.
- The breaches come as banks and financial firms across Japan and South Korea face a wave of intrusions, some tied to AI-assisted hacking.
Securitize Japan experienced a cyberattack that exposed customer data in the possession of Sony Bank, NTT Data, and Marui Group.
The three companies acknowledged the breach, while investigations continue. This comes amidst a wave of security breaches among financial firms in South Korea and Japan. Securitize Japan is the Japanese arm of Securitize, a US tokenization firm.
617 names and four full profiles leaked at Sony Bank
On October 30, Sony Bank spotted the incident when it noticed a hack on an outside contractor that handles its digital securities. On Wednesday, November 4, 2026, Sony Bank revealed Securitize Japan to be the contractor.
There wasn’t significant damage; however, 617 individuals had their names revealed, while four customers had their full profiles stolen.
Sony Bank has decided to halt its digital securities trading service until the right safety measures are in place. At the moment, no fraudulent transactions have been detected, nor has the stolen data been publicized. The breach did not affect other services offered by Sony Bank.
Sony Bank started offering digital securities on Securitize Japan in 2023, even using Securitize Japan to raise funds against music-rights investments in 2026. Digital securities are financial products whose ownership and rights records are tracked on a blockchain.
Securitize spotted the breach on October 29
Securitize Japan noticed unusual activity within its systems on the 29th of October, 2026. The company immediately traced the activity to an external intruder. Sony Bank was then notified, while Securitize Japan carried out a review of access logs later on. The review revealed customer records had been stolen from the system.
Sony Bank has decided to reach out to affected customers one by one while setting up a hotline to answer any questions.
NTT Data and Marui Group were affected too
NTT Data and Marui Group are some other clients of Securitize Japan that were also affected in the breach. NTT Data announced on the 2nd of November 4, 2026, that buyer of corporate bonds had their personal data leaked via a Securitize Japan Service.
The hackers took advantage of a flaw in the platform’s authentication to take charge of administrator rights and steal data.
Marui Group, on the other hand, faced a different challenge. Up to 9,086 individuals who had opened accounts for the sole purpose of applying for digital bonds had some personal information exposed: information like names, addresses, phone numbers, email addresses, dates of birth, gender, and the number of investment units purchased.
About 54 applicants had their bank accounts exposed.
A bad run for East Asian finance
This incident adds to a difficult time for the financial sector in East Asia. Not long ago, about 80 Japanese insurers, financial companies and logistics firms were attacked, and ARTEX was found to have been used in the attack. ARTEX is an open-source penetration-testing AI tool built in China. Investigators traced six overseas servers used against Japanese targets between September 18 and October 18.
Another set of bank intrusions was discovered to be tied to ARTEX in South Korea. ARTEX was paired with large language models, like Claude Code, in carrying out these attacks. Around 100,000 records were leaked from 16 financial institutions, including Shinhan Bank and KB Kookmin Bank.
Cryptopolitan reported that Korean police later opened a preliminary investigation into breaches at crypto exchange Bithumb, Daishin Securities and Mirae Asset Global Investments, with 38,490 Daishin clients exposed.
None of the public reporting has connected the Securitize Japan incidents to ARTEX. NTT Data attributed its breach to an authentication flaw rather than naming a specific attacker or tool.
If you're reading this, you’re already ahead. Stay there with our newsletter.
FAQs
What data was leaked in the Sony Bank breach?
Four customers had their names, addresses, dates of birth and account numbers exposed, and another 617 people had their names leaked, according to Sony Bank.
How did attackers get into Securitize Japan's systems?
NTT Data said attackers exploited a weakness in the platform's authentication to gain administrator privileges and remove data. Securitize Japan detected the abnormal activity on October 29 and identified it as external access the same day.
How many people did the Marui Group breach affect?
Up to 9,086 digital bond applicants had some personal information exposed, with as many as 54 potentially having bank account numbers leaked, according to Security Taisaku Lab.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
