Japan warns of hundreds of millions of dollars in unauthorized trades from hacked accounts

Avatar

Japanese regulators published an urgent warning about hundreds of millions of dollars worth of unauthorized trades being conducted on hacked brokerage accounts in the country. 

Japan’s Financial Services Agency (FSA) said on Friday that there has been a “sharp increase in the number of cases of unauthorized access and unauthorized trading” through online trading services. 

The trend was occurring, according to the agency, because of stolen customer information obtained through phishing websites “disguised as websites of real securities companies.”

As of April 16, the FSA said 12 securities firms reported fraudulent transactions, with sales totaling about $350 million and purchases worth about $315 million. 

“There are various types of fraudulent transactions, but in most cases, the fraudsters gain unauthorized access to victim accounts and manipulate them to sell stocks etc. in the accounts, and use the proceeds to buy Chinese stocks etc,” officials explained. 

“As a result of the fraudulent transactions, the Chinese stocks etc. remain in the victim accounts.”

The agency noted that there “may still be cases of unauthorized access or fraudulent transactions that have not yet been discovered.”

According to the figures reported to the FSA, accounts were accessed illegally more than 3,300 times and there were 1,454 fraudulent transactions. 

Bloomberg reported that some of the firms notifying the FSA of incidents include Rakuten Securities Inc., Nomura Holdings Inc., SMBC Nikko Securities Inc. and SBI Holdings Inc.

During a press conference on Friday, the FSA said brokerages will be covering the losses suffered by their customers

Japan has increasingly warned its citizens of cyberattacks targeting the country from China. At the Munich Cyber Security Conference last year, a senior official within the country’s National Center of Incident Readiness and Strategy for Cybersecurity said China-backed hackers are increasingly targeting telecom carriers, internet providers and other critical infrastructure.

CybercrimeGovernmentNewsNews Briefs
Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Jonathan Greig

is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

 

Total
0
Shares
Previous Post

Alleged SmokeLoader malware operator facing federal charges in Vermont

Next Post

Texas city takes systems offline after cyberattack

Related Posts

Cisco Confirms Active Exploits Targeting ISE Flaws Enabling Unauthenticated Root Access

Cisco on Monday updated its advisory of a set of recently disclosed security flaws in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) to acknowledge active exploitation. "In July 2025, the Cisco PSIRT [Product Security Incident Response Team], became aware of attempted exploitation of some of these vulnerabilities in the wild," the company said in an alert. The
Avatar
Read More

Malware Injected into 5 npm Packages After Maintainer Tokens Stolen in Phishing Attack

Cybersecurity researchers have alerted to a supply chain attack that has targeted popular npm packages via a phishing campaign designed to steal the project maintainers' npm tokens. The captured tokens were then used to publish malicious versions of the packages directly to the registry without any source code commits or pull requests on their respective GitHub repositories. The list of affected
Avatar
Read More

nOAuth Vulnerability Still Affects 9% of Microsoft Entra SaaS Apps Two Years After Discovery

New research has uncovered continued risk from a known security weakness in Microsoft's Entra ID, potentially enabling malicious actors to achieve account takeovers in susceptible software-as-a-service (SaaS) applications. Identity security company Semperis, in an analysis of 104 SaaS applications, found nine of them to be vulnerable to Entra ID cross-tenant nOAuth abuse. First disclosed by
Avatar
Read More