Securitize Japan breach leaks data at Sony Bank, NTT Data and Marui

Securitize Japan got hit by hackers, and the fallout is landing on three of its biggest clients. Sony Bank, NTT Data and Marui Group all confirmed customer data was exposed in the breach, according to Cryptopolitan. Sony Bank has already pulled the plug on its digital securities trading service until it can guarantee the security is airtight.

The timeline is tight. Securitize Japan spotted odd activity inside its systems on October 29 and traced it to an outsider. Sony Bank got the heads-up the next day and only named Securitize Japan as the compromised contractor on November 4. A later review of access logs confirmed customer records had been lifted — hackers slipped through a flaw in the platform's authentication and seized administrator rights.

The damage reports vary by client. At Sony Bank, 617 people had their names exposed and four customers lost full profiles. Marui Group is dealing with a bigger spill: up to 9,086 people who opened accounts purely to apply for digital bonds had names, addresses, phone numbers, emails, birth dates, gender and investment unit counts exposed, with roughly 54 applicants' bank accounts caught too. NTT Data said corporate bond buyers had personal data leaked through a Securitize Japan service.

So far, no fraudulent transactions have been spotted and none of the stolen data has surfaced publicly. Sony Bank says its other services were untouched and is calling affected customers one by one while standing up a hotline. It first started offering digital securities through Securitize Japan back in 2023 and even used the platform to raise money against music-rights investments in 2026.

The breach lands in the middle of a rough stretch for East Asian finance. Roughly 80 Japanese insurers, financial firms and logistics companies were recently attacked using ARTEX, an open-source penetration-testing AI tool built in China, with investigators tracing six overseas servers used against Japanese targets between September 18 and October 18. South Korean banks got hit too, with ARTEX paired with large language models like Claude Code — about 100,000 records leaked from 16 financial institutions including Shinhan Bank and KB Kookmin Bank.

Cryptopolitan has reported that Korean police opened a preliminary investigation into breaches at crypto exchange Bithumb, Daishin Securities and Mirae Asset Global Investments, where 38,490 Daishin clients were exposed. No public reporting has tied the Securitize Japan attack to ARTEX. NTT Data pointed to an authentication flaw instead of naming an attacker or a tool.