Commentary
OSAKA—On Oct. 14, Osaka-based IwaiCosmo Securities suffered a breach in which unauthorized buy and sell orders were executed directly across retail customer accounts. System logs revealed that orders were placed in seven customer accounts, with trades successfully executed in five of them.
Personal data belonging to 4,975 individuals was also exposed, but that is turning out to be a mere footnote to the main issue.
IwaiCosmo and its software provider, Tokyo-based TradeWorks, confirmed that no customer login credentials or passwords were stolen or used. Instead, attackers breached a critical configuration vulnerability within administrative and maintenance functions on TradeWorks’ backend infrastructure.
Cybersecurity expert and professor emeritus Masakatsu Morii of Kobe University expressed his alarm at this development. “I have never heard of this in Japan. It is an attack on a different dimension from personal information leakage.”
A Paradigm Shift in Cyber Risk
To understand why cybersecurity experts view the IwaiCosmo incident as a watershed moment for financial infrastructure, it’s necessary to contrast it with standard cybercrime techniques.
For retail financial hacking, the typical playbook has attackers relying on account takeover strategies. The first step involves perpetrators harvesting individual user credentials such as usernames, passwords, SMS two-factor authentication codes, or session cookies. They typically achieve this via phishing, malware campaigns, or credential-stuffing databases.
The second step is when the attacker impersonates the customer, logging into customer-facing portals to execute unauthorized transactions or transfers.
While account takeover remains widespread across global retail brokerages and banking apps, its scope is limited to individual endpoints—namely, user passwords.
Systemic Impersonation
What transpired at IwaiCosmo completely bypassed this threat model. Customer passwords and passkeys played no role, and victims’ individual account hygiene was irrelevant.
The unknown adversary here never bothered with compromising customer-facing authentication layers, and instead infiltrated back-end maintenance and order-routing engines maintained by a software vendor working with IwaiCosmo.
Rather than masquerading as, say, isolated traders logging into a mobile app, the attackers compromised core operational channels. They effectively impersonated the securities firm itself to inject automated, unauthorized orders directly into the market.
Internal Threat Vectors
Major financial hackers targeting internal bank computers or private network channels have been seen before, but there are major differences in the IwaiCosmo case.
For example, during the Bangladesh Bank heist of 2016, attackers used malware to break into the bank’s internal systems and steal credentials for the SWIFT network, the global messaging system banks use to send money to each other.
The hackers posed as authorized bank employees, sent fake transfer requests, and successfully stole nearly $81 million from the central bank’s account at the Federal Reserve Bank of New York. In this case, however, user passwords were still part of the equation.
In the IwaiCosmo case, the hackers broke into a third-party software company’s maintenance system and automatically placed unauthorized trades inside regular customer accounts. For these orders, they never required a single IwaiCosmo username or password to complete the trades.
Standard IT security in financial institutions allocates substantial capital to secure front-end access, i.e., deploying biometric logins, hardware keys, and encrypted sessions. But if attackers are now able to exploit a single configuration error at a shared third-party software vendor, this security perimeter is effectively guarding the wrong gate.
Structural Integrity and Trust Models
In 2020, CISA issued an alert about FASTCash 2.0, in which North Korea targeted banks in multiple countries to create fraudulent international money transfers and ATM cash outs. FASTCash operated by compromising a bank’s switch application server (payment processing server) and injecting malware that intercepted financial request messages.
When a cash withdrawal request hit the server, the malware automatically generated a fake response code approving the request without checking account balances or user credentials.
The result was tens of millions of dollars stolen across dozens of countries, as hijacked payment switch servers forced compromised bank systems to approve fraudulent, large-scale ATM cash withdrawals regardless of actual account balances or user credentials.
Common Systems
Banks and brokerages often rely on the same outside software companies. Account Takeovers impact isolated retail accounts until contained. A compromised core transaction engine, much like FASTCash 2.0, could arguably hand the underlying operational keys to an adversary.
If this structural breach vector is applied to core banking environments or automated clearing networks (transaction platforms), malicious actors could manipulate double-entry ledgers, alter balances, or route institutional wire transfers at scale without triggering consumer-level controls to stop it.
As seen with the 2008 subprime or 1980s S&L crisis, a fundamental flaw or failure with several providers, regardless of the reason, has the potential to endanger a much larger swath of the financial system.
“This time it involved a securities company,” Morii said, “but it is the kind of incident that raises concerns that attackers could, in some cases, breach a bank’s system and move funds under their control.” In terms of how likely this might happen, Morii said, “It is difficult to say the possibility is zero.”
The Epoch Times copyright © 2026. The views and opinions expressed are those of the authors. They are meant for general informational purposes only and should not be construed or interpreted as a recommendation or solicitation. The Epoch Times does not provide investment, tax, legal, financial planning, estate planning, or any other personal finance advice. The Epoch Times holds no liability for the accuracy or timeliness of the information provided.
