Threat watch / Breach
Monex Securities: up to 1.13 million email addresses may have leaked from a vendor-run account-opening system
Japanese broker Monex Securities says a third party accessed part of its account-opening system, run and managed by an outsourced vendor. On November 13, 2026 it said up to 1.13 million email addresses and 1,592 identity document images may have leaked. Account numbers and passwords sat in a different database and are not confirmed leaked, and no fraud has been reported so far.
- Sector
- Finance
- Way in
- Not public yet
- Product or vendor
- None named
- email addresses that may have leaked (maximum so far, includes duplicates and unfinished applications), plus 1,592 ID document images[1]
- 1.13M
- How it happened
- A third party accessed part of the online account-opening system run and managed by an outsourced vendor, which the vendor noticed on October 18, 2026. Monex has not named the vendor and says the cause and exact sequence of the access are still under investigation.[1] Checked 14 Nov 2026
- What was stolen
- Email addresses entered as the first step of an online account application since October 16, 2019, and images of identity documents from applicants who used the photo method: My Number card front side, driver's license front and back, and selfies. Monex says no My Number personal numbers, account numbers, login or trading passwords are confirmed leaked.[1] Checked 14 Nov 2026
- Who was impacted
- People who started an online Monex account application since October 16, 2019, including some who never finished it. New online account openings have been suspended since October 19.[1][2] Checked 14 Nov 2026
- Threat actor
- Not attributed
Timeline
- The outsourced vendor sees attempts by a third party to access the account-opening system it runs for Monex. [1]
- Monex cuts external access to the system and suspends new online account openings as a precaution. [1][2]
- The suspension and the suspicious access to a vendor-managed system are reported publicly. [3]
- Account applications by mail resume; online applications stay suspended. [2]
- Based on an interim forensic report by an outside firm, Monex says up to 1.13 million email addresses and 1,592 ID document images may have leaked. It says no misuse, phishing, unauthorized trades or impact on customer assets has been confirmed, and it will notify affected people individually. [1][4]