Securitize Japan Breach Exposed 617 Sony Bank Customer Names

Sony Bank Suspends Digital Securities Trading

Securitize Japan, the Tokyo unit of the United States tokenization firm Securitize, has suffered a cyberattack that exposed customer data in the hands of Sony Bank, NTT Data and Marui Group. All three companies have acknowledged the breach, and their investigations remain open. Sony Bank was the first to flag trouble. On October 30 it detected a hack at an outside contractor that handles its digital securities, and on Wednesday it identified that contractor as Securitize Japan. The bank's official notice, published on November 4, confirms the identification and closes a five-day gap between detection and disclosure.

The exposed volume at the bank is modest. 617 individuals had their names revealed, and four customers lost their full profiles. Sony Bank said the incident caused no significant damage beyond that, with no fraudulent transactions detected so far and no sign that the stolen data has been made public. Services outside digital securities were untouched. The bank has nonetheless suspended its digital securities trading service until it has the right safety measures in place, and it is contacting affected customers one by one while operating a hotline for questions.

The relationship with the vendor goes back years. Sony Bank began offering digital securities through Securitize Japan in 2023 and used the platform again in 2026 to raise funds against music-rights investments. Digital securities are financial products whose ownership and rights records are tracked on a blockchain, which places custody of those records with a specialist provider rather than the bank itself. That structure is what placed the bank's customer list inside another company's network perimeter when the intrusion happened.

NTT Data and Marui Group Disclose Exposure

Securitize Japan's own timeline starts a day earlier. The company noticed unusual activity inside its systems on October 29, traced it to an external intruder, and notified Sony Bank. A subsequent review of access logs showed that customer records had been taken from the system.

Two other corporate clients disclosed exposure this week. NTT Data said on November 4 that buyers of corporate bonds had personal data leaked through a Securitize Japan service. Its investigators attributed the intrusion to a flaw in the platform's authentication, which the attackers used to seize administrator rights and pull data. Marui Group reported a larger exposure surface: up to 9,086 people who opened accounts solely to apply for digital bonds had names, addresses, phone numbers, email addresses, dates of birth, gender and the number of investment units purchased exposed, and about 54 applicants also had their bank account details taken.

The episode lands during a difficult stretch for East Asian finance. Roughly 80 Japanese insurers, financial companies and logistics firms were attacked in recent weeks through ARTEX, an open-source penetration-testing AI tool built in China, with six overseas servers used against Japanese targets between September 18 and October 18. In South Korea, intrusions tied to the same tool reached 16 financial institutions, including Shinhan Bank and KB Kookmin Bank, with around 100,000 records leaked. Korean police have also opened a preliminary investigation into breaches at crypto exchange Bithumb, Daishin Securities and Mirae Asset Global Investments, where 38,490 Daishin clients were exposed. Public reporting has not connected the Securitize Japan incidents to ARTEX, and NTT Data named an authentication flaw rather than any specific attacker or tool.

The pattern across the disclosures matters more than any single figure. Securitize Japan sits behind digital securities programs at several large institutions at once, so one authentication flaw reached a bank, a technology group and a consumer lender from a single point of failure. The countermeasures each client chose tell their own story: Sony Bank suspended trading rather than operate on an unverified perimeter, the conservative call when record-keeping sits with a vendor. Unlike the most common smart contract attacks, which target on-chain code, this breach lived in the administrative layer, the part that tighter authentication and routine access-log review are built to cover. No fraudulent transactions have surfaced so far, so the damage is informational rather than financial. What remains unconfirmed is the attacker's identity: neither NTT Data nor Marui Group has named one, and the ARTEX campaign stays a separate, unlinked investigation for now.