Japan’s Monex Securities says an interim forensic investigation has identified up to 1.13 million email-address records and 1,592 identity-document image records that may have been exposed through unauthorized access to an outsourced account-opening system. The November 13 disclosure is the first detailed estimate of possible personal-data exposure from an incident the brokerage initially reported in October.
The figures describe records within the investigation’s potential exposure scope, not confirmed theft of 1.13 million unique customers’ information. Monex says the email total includes duplicates, incomplete applications and people who never finished opening an account. Investigators have not yet identified which individual identity-document images may have been accessed.
The brokerage says it has found no unauthorized trades, customer asset losses or disruption to existing account logins and trading linked to the incident. Some new-account opening functions remain suspended, however, while an outside specialist and the unnamed system provider continue their investigation.
Potential exposure includes ID cards and selfie images
Monex said the affected email addresses were registered from October 16, 2019 onward as the first step in an online brokerage-account application. That explains why the pool could include people who are not current customers. Its November 13 company disclosure identifies a maximum of 1,130,000 records, not an independently verified count of accounts compromised.
The more sensitive potential exposure concerns 1,592 image records submitted through an account-verification process requiring photographs. Those records may include the front and back of Japanese driving licences, the front of My Number cards and selfie images. Monex has not yet mapped those records to named individuals or disclosed how many applicants used each document type.
The company says it has found no exposure of the personal identification number printed on the reverse side of a My Number card. It also says information supplied through the alternative electronic identity-authentication method using My Number cards has not been shown to be affected.
Account numbers, login passwords and trading passwords were stored outside the affected database, and Monex says their disclosure has not been established. This is an important boundary, but not a guarantee that information from an onboarding application cannot later be used to support a convincing impersonation attempt.
In a different customer-verification incident, Based disclosed a compromise involving card-related KYC information while explicitly excluding photographs and liveness-verification images from its affected dataset. Monex’s investigation includes photographic identity material within its potential scope, although confirmed exposure of any specific image is still being examined.
Third-party onboarding system was isolated on October 19
The incident dates back to October 18, when the external provider operating part of Monex’s account-opening infrastructure detected an attempted unauthorized connection. After being notified, the brokerage blocked external access to that system on October 19 and stopped some new brokerage-account applications. It first publicly disclosed the disruption on October 20, without a quantified data-exposure estimate.
By November 13, the forensic team’s interim findings indicated that information managed by the isolated system may have leaked externally. Monex says monitoring has found no additional unauthorized access since isolation, but has not described the initial entry point, the attacker or the method by which any data might have been taken.
Crucially, the affected onboarding environment is seperate from the core system managing existing brokerage accounts, balances and trades. Monex says current customers can continue logging in and transacting normally. That is a company-reported operational finding, not evidence that the potentially exposed identity records are harmless.
The structure resembles another outsourced-brokerage data risk: DriveWealth’s September data incident affected historical records linked to Revolut brokerage customers even after some of those users had left the original service arrangement. There is no connection between the incidents, but both show how an external provider can retain sensitive data outside the customer’s main trading application.
Japan has seen separate attacks on other financial-service providers this autumn. GMO’s FX-oriented cloud service suffered a confirmed intrusion and extortion attempt in October, with some users reporting unrecognized trading activity. That case involved a different provider and systems; its confirmed operational and financial reports must not be projected onto Monex, which has reported no such trade impact.
Monex has not identified affected applicants or a restart date
Monex says applicants whose personal-information disclosure is confirmed will receive individual notices under the applicable legal requirements. The company has not announced how many people currently meet that threshold, which outside vendor operates the compromised system, or how long the ongoing onboarding suspension will continue.
Affected email records could support targeted phishing attempts if obtained by criminals, especially when combined with knowledge that someone applied for a brokerage account. That remains a potential risk rather than a reported consequence: Monex says it has received no confirmed reports of misuse or phishing losses arising from this incident.
The firm warns customers not to follow links in suspicious emails or text messages, and says it does not use those channels to ask customers to log in. It also says it does not request login or trading passwords through email, SMS or telephone. Anyone who receives an unexpected security or identity-verification request should verify it through the company’s established support channels instead.
Investigators still need to establish whether the possible data was actually copied, which applicants were involved and how access to the outsourced system was obtained. The onboarding shutdown has remained in place since October 19 for the affected functions, but Monex has not supplied a financial cost or a resumption schedule. For now, the disclosure quantifies a potentially serious privacy exposure without establishing stolen trading credentials or lost customer funds.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.