{
  "id": "smbc-nikko-share-plan-data",
  "url": "https://ohshit.app/incidents/smbc-nikko-share-plan-data/",
  "title": "SMBC Nikko confirms a breach of its employee share plan system",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-11",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "SMBC Nikko",
    "employee share plans",
    "data breach"
  ],
  "ecosystems": [],
  "summary": "SMBC Nikko confirmed that data from its share plan administration system leaked. Up to 56,487 members may be affected. Records can include names, addresses, holding balances and destination account details.",
  "splash": "Members of employee share plans administered through the affected SMBC Nikko system.",
  "wipe": "Confirm your plan’s notice with its administrator. Verify any transfer instructions through an established channel.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Confirm whether your plan was affected",
      "hint": "Contact your existing employer or share plan administrator. The broker’s notice also lists 0120-715-250 for members in Japan. Ask which fields were involved and follow the broker’s official reopening notice before retrying stalled operations."
    },
    {
      "title": "Verify changes to transfer instructions",
      "hint": "Confirm unfamiliar transfers or destination-account changes through a known contact. Review plan statements and account records when available, preserve evidence of discrepancies and report them to the administrator and broker."
    },
    {
      "title": "Reconcile member records before issuing notices",
      "hint": "Plan administrators should obtain the broker’s scoped notification and compare it with membership and transfer records. Preserve an audit trail and notify members through established channels."
    }
  ],
  "sources": [
    {
      "name": "SMBC Nikko incident disclosure",
      "url": "https://www.smbcnikko.co.jp/news/release/2026/pdf/261111_01.pdf",
      "says": "Confirms the leak, suspension, potential fields, upper bound and plan-level notification process.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "SMBC Nikko confirms unauthorized access and a leak of some member data.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 9, 2026",
      "title": "Broker detects unauthorized access and suspends the system",
      "body": "SMBC Nikko cut access to the affected system the same day."
    },
    {
      "date": "Nov 11, 2026",
      "title": "Broker confirms the leak and gives an upper bound",
      "body": "The company says it will contact the affected or potentially affected plans individually."
    }
  ],
  "body_markdown": "The broker says some members’ data leaked and puts the potentially affected population at up to 56,487. The fields vary by member and may include the plan name, investment securities, member ID, name, address, dividends and taxes, holdings balance and destination account details. The system did not store phone numbers or email addresses. The broker reported no known secondary harm when it issued the notice.\n\nThe disclosure covers the system used to administer employee share plans, including member holdings calculations. SMBC Nikko is investigating the entry route and detailed scope. It plans to notify affected or potentially affected plans directly and announce reopening through direct notices or its website."
}