Monex Securities Breach May Expose Up to 1.13 Million Email Addresses

Japanese online broker Monex Securities said on 13 November 2026 that an attacker accessed an account-opening system run for it by an outside contractor, and that up to 1.13 million email addresses may have leaked. The addresses are the ones people typed in as the first step of an online account application since 16 October 2019, so the list also covers applicants who never finished opening an account.

A smaller set of 1,592 identity document images, uploaded by applicants who used the photo-based verification method, may also have leaked. Monex says account numbers, login passwords and trading passwords sit in a separate database and were not leaked, and that no unauthorised trading has been confirmed.

What Monex disclosed

According to the Monex Securities press release, the contractor detected an unauthorised access attempt by a third party on 18 October 2026. Monex cut off external access to the system the next day and suspended part of its account opening. The interim report from an external forensic firm, received on 13 November, found that some personal information may have been taken. The cause is still under investigation.

The 1,592 document images may include the front of My Number cards (not the back, which shows the individual number), both sides of driving licences and selfie images. Monex has not yet identified which records are affected and says it will notify the people concerned individually. Online and app account opening remains suspended; applications by post are still accepted.

Why an email list leak matters even without passwords

A list of addresses tied to one brand is exactly what a phishing campaign needs. Everyone on it has shown an interest in opening a brokerage account, which makes a fake "verify your account" or "complete your application" message far more convincing than a random spam run. Monex says it has received no reports of misuse or phishing linked to the incident so far, and warns customers to be wary of emails and SMS claiming to come from Monex or other financial institutions. It adds that it never asks for login details by email, SMS or phone.

The pattern is familiar: in November the SEGA newsletter breach at ARARA also exposed millions of addresses through a third party that handled the data. In both cases the brand's own core systems were not the weak point; a supplier holding email data was.

Action checklist

• Enforce DMARC on every domain your brand sends from, and on parked domains, so spoofed mail is rejected rather than delivered. Our guide to DMARC reject vs quarantine covers the move.
• Watch your DMARC reports for spikes of unauthenticated mail using your domain, a common early sign of a phishing run.
• Keep sensitive actions out of email links: tell customers to log in through your app or a typed address, and say so in every security message.
• Audit contractors that hold email data, including sign-up forms, KYC and onboarding vendors, and delete applicant data you no longer need.
• Prepare a breach notice template that is plain text friendly, contains no login links and is sent from your authenticated main domain.

Sources

1. Monex Securities: notice of possible personal information leak through unauthorised access to an outsourced account-opening system, 13 November 2026 (primary source, in Japanese)

Related on SMTPedia

• SEGA newsletter breach at ARARA exposes 2.2 million email addresses
• How to detect phishing emails that pass every check
• DMARC reject vs quarantine: when to move and how