(Original Video in Japanese was published on the FINOLAB CHANNEL on Jun. 24, 2025 by Makoto Shibata)
Since March 2025, Japan’s online securities industry has seen a rapid increase in unauthorized access incidents. Large-scale and automated attacks have targeted multiple securities companies, pushing the entire industry to respond.
The Reality of the Attacks: Over 17 Companies Targeted, Stock Manipulation Tactics Involved
While initially limited, incidents expanded rapidly by the end of May, affecting over 17 companies. Attackers have been selling customer-owned stocks and using the proceeds to purchase low-liquidity, small-cap stocks—primarily in China and Japan—in large volumes. These tactics are believed to be a form of market manipulation: perpetrators pre-purchase small-cap stocks, artificially inflate their prices, and then sell them for a profit.
Attack Methods: From Phishing to Sophisticated AI-Powered Malware
The attackers have employed several methods:
- Highly convincing phishing sites and emails mimicking real securities firms
- Info-stealer malware that extracts login credentials from infected devices
- Adversary-in-the-middle (AiTM) attacks that intercept session data and bypass multi-factor authentication (MFA)
These threats are compounded by poor password practices and low security awareness among users, such as reusing passwords or clicking on suspicious links.
Industry Issues: Lagging Security Measures and Balancing User Convenience
The securities industry has been criticized for delayed implementation of MFA and maintaining multiple vulnerable login pathways (e.g., PC, mobile apps, third-party integrations). A strong focus on user convenience has often taken priority over security measures, making the systems more exploitable.
What’s Being Done: Industry-Wide Compensation and Strengthened Security
In May 2025, the Japan Securities Dealers Association announced that major online brokerages would offer compensation for losses due to phishing scams, regardless of existing terms and conditions.
Key initiatives include:
- Mandatory MFA (via One Time Password(OTP), SMS, smartphone app, or phone callback)
- Real-time transaction monitoring and alerting
- Swift freezing of compromised accounts
- Shared industry blacklists and incident intelligence
Conclusion: A Dual Response from Users and the Industry is Critical
These incidents show that relying solely on ID and password-based logins is no longer viable. Enhancing users’ security awareness and upgrading system-wide defenses are both essential.