{
  "id": "tradewaltz-trade-document-breach",
  "url": "https://ohshit.app/incidents/tradewaltz-trade-document-breach/",
  "title": "TradeWaltz confirms theft of 130 trade documents after contractor key abuse",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-10",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "TradeWaltz",
    "third party",
    "data breach"
  ],
  "ecosystems": [],
  "summary": "TradeWaltz says an attacker abused an administrative access key stored on a compromised contractor server. The provider stopped production and training, confirmed 130 trade documents were taken and completed direct notices to identified customers.",
  "splash": "TradeWaltz customers with documents in production or training, both breached through an abused administrative key.",
  "wipe": "Verify any notice with TradeWaltz and review exposed documents and related trade instructions.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Verify notices and identify affected files",
      "hint": "Use the established TradeWaltz help desk or account contact. Confirm document identifiers and fields with the provider, and compare them with your own shipment and document records. Preserve notices and suspicious requests."
    },
    {
      "title": "Verify unexpected trade instructions through a known channel",
      "hint": "Independently verify payment, shipping or document changes with the relevant counterparty. Send suspicious requests and unexpected reset emails to the established help desk. Avoid unexpected links and attachments, and do not provide passwords, codes or API keys in response."
    },
    {
      "title": "Check environment status before resuming work",
      "hint": "Consult the provider’s incident notice before retrying submissions. Use approved contingency channels for urgent work and reconcile submissions after reopening. For operators with outsourced administrative access, audit its use and rotate any exposed keys from a trusted environment."
    }
  ],
  "sources": [
    {
      "name": "TradeWaltz incident notices and November 12 scope update",
      "url": "https://www.tradewaltz.com/news/13816/",
      "says": "Confirms the contractor key abuse, 130 trade documents, customer notices and service scope.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "TradeWaltz confirms unauthorized access and acquisition of 130 trade documents.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 10, 2026",
      "title": "TradeWaltz detects intrusion and takes two environments offline",
      "body": "The provider removes abused and attacker-created accounts, restricts source IP addresses and starts analyzing logs."
    },
    {
      "date": "Nov 11, 2026",
      "title": "Provider confirms document theft and identifies the key abuse",
      "body": "The provider reports that the key was stored on an external contractor server that had been attacked."
    },
    {
      "date": "Nov 12, 2026",
      "title": "TradeWaltz completes direct notifications and scopes 130 documents",
      "body": "The provider says the documents included names and initials. Production and training remain suspended."
    }
  ],
  "body_markdown": "The provider first disclosed the intrusion and service suspension on November 10. It says the attacker used a system administration key stored on a server operated by an external contractor. TradeWaltz confirmed intrusions into both production and training, shut those environments down and submitted an initial report to Japan’s Personal Information Protection Commission.\n\nIn its November 12 update, the company says 130 trade documents were taken and that the documents included names and initials. The number describes documents. It has not published a distinct count of people or customers. The provider completed individual contact with identified affected customers. TradeWaltz for Grain Importers and TradeWaltz for Export Documentary remained available. The provider considers reopening through November 13 unlikely. It scheduled an incident update for November 13 at 13:00 Japan time and expects to give an outlook for reopening from November 14 onward by 17:00 Japan time on November 13."
}