Osaka broker Iwai Cosmo Securities published a second report on Oct 20 about the breach at TradeWorks (トレードワークス), which runs and maintains its online-trading system. A re-check of access and network logs found 364 more affected customers, bringing the total to 4,975 (name, email address and other fields within what it disclosed on Oct 16). The broker says these came from the original intrusion, not a new one. Trading PINs were not included, and the leaked data can't be used to log in or trade.

New in this report: on Oct 14, the day of the intrusion, the order-management system was also attacked, and unintended buy/sell orders were placed in 7 accounts, 5 of which were executed. Iwai Cosmo says it contacted those customers the same day and reversed the trades at no cost to them. It delayed disclosing this until countermeasures were in place, and says the fraudulent trades did not use the leaked personal data. TradeWorks has fixed the entry point, added access restrictions on admin functions, login-anomaly detection and more monitoring. TradeWorks says it checked the systems it provides to other financial firms and found no similar intrusion.

Our read (opinion): this is a different route from the 2025 wave of Japanese account-takeover trading fraud. Here orders were placed through the broker's systems vendor, not through stolen customer logins. If you run a brokerage, review what admin or order-entry functions your trading-system vendor exposes and who can reach them.