SMBC Nikko confirms a breach of its employee share plan system
SMBC Nikko confirmed that data from its share plan administration system leaked. Up to 56,487 members may be affected. Records can include names, addresses, holding balances and destination account details.
- Disclosed
- Nov 11, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Members of employee share plans administered through the affected SMBC Nikko system.
- SMBC Nikko · employee share plans · data breach
- In the wild
- Yes
- SMBC Nikko confirms unauthorized access and a leak of some member data.
What happened
The broker says some members’ data leaked and puts the potentially affected population at up to 56,487. The fields vary by member and may include the plan name, investment securities, member ID, name, address, dividends and taxes, holdings balance and destination account details. The system did not store phone numbers or email addresses. The broker reported no known secondary harm when it issued the notice.
The disclosure covers the system used to administer employee share plans, including member holdings calculations. SMBC Nikko is investigating the entry route and detailed scope. It plans to notify affected or potentially affected plans directly and announce reopening through direct notices or its website.
Crime-scene timeline
Nov 9, 2026
Broker detects unauthorized access and suspends the system
SMBC Nikko cut access to the affected system the same day.
Nov 11, 2026
Broker confirms the leak and gives an upper bound
The company says it will contact the affected or potentially affected plans individually.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- SMBC Nikko incident disclosurePrimaryConfirms the leak, suspension, potential fields, upper bound and plan-level notification process.