TradeWaltz confirms theft of 130 trade documents after contractor key abuse
TradeWaltz says an attacker abused an administrative access key stored on a compromised contractor server. The provider stopped production and training, confirmed 130 trade documents were taken and completed direct notices to identified customers.
- Disclosed
- Nov 10, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- TradeWaltz customers with documents in production or training, both breached through an abused administrative key.
- TradeWaltz · third party · data breach
- In the wild
- Yes
- TradeWaltz confirms unauthorized access and acquisition of 130 trade documents.
What happened
The provider first disclosed the intrusion and service suspension on November 10. It says the attacker used a system administration key stored on a server operated by an external contractor. TradeWaltz confirmed intrusions into both production and training, shut those environments down and submitted an initial report to Japan’s Personal Information Protection Commission.
In its November 12 update, the company says 130 trade documents were taken and that the documents included names and initials. The number describes documents. It has not published a distinct count of people or customers. The provider completed individual contact with identified affected customers. TradeWaltz for Grain Importers and TradeWaltz for Export Documentary remained available. The provider considers reopening through November 13 unlikely. It scheduled an incident update for November 13 at 13:00 Japan time and expects to give an outlook for reopening from November 14 onward by 17:00 Japan time on November 13.
Crime-scene timeline
Nov 10, 2026
TradeWaltz detects intrusion and takes two environments offline
The provider removes abused and attacker-created accounts, restricts source IP addresses and starts analyzing logs.
Nov 11, 2026
Provider confirms document theft and identifies the key abuse
The provider reports that the key was stored on an external contractor server that had been attacked.
Nov 12, 2026
TradeWaltz completes direct notifications and scopes 130 documents
The provider says the documents included names and initials. Production and training remain suspended.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- TradeWaltz incident notices and November 12 scope updatePrimaryConfirms the contractor key abuse, 130 trade documents, customer notices and service scope.