What happened in the SMBC Consumer Finance breach
On Monday, November 2, 2026, security engineers at SMBC Consumer Finance (SMBCCF) noticed unusual traffic on the systems that power its third-party credit guarantee business. SMBCCF is the consumer finance arm of Sumitomo Mitsui Financial Group and the operator of the Promise lending brand. Within hours, it cut the environment off from external networks.
At that point the company told several partner banks that forensic indicators had not confirmed any loss of personal data. That assessment lasted about three days. As incident responders went through outbound traffic logs and rebuilt the timeline, they found that an unauthorized party had queried and sent out personal and financial records belonging to up to 320,118 people.
On Thursday, November 5, and Friday, November 6, breach notices started appearing across the Japanese banking sector. Resona Bank, Kansai Mirai Bank, Minato Bank, the Bank of Yokohama, Docomo SMTB Net Bank (formerly Sumishin SBI Net Bank), Ehime Bank, Tsukuba Bank, Eighteenth Shinwa Bank, Sanju-San Bank, Tajima Bank, Toyama Bank and Tottori Bank all confirmed that their customers’ loan application and guarantee histories were caught up in the incident. None of them had been breached directly, and their core banking systems and internal networks were untouched. The exposure came from a centralized, multi-tenant credit underwriting and loan guarantee platform that SMBCCF operates for 189 partner financial institutions.
How the Japanese loan guarantee model works
To see why a single consumer finance subsidiary could stall loan originations and expose customer records at dozens of competing banks, it helps to look at how unsecured retail lending is built in Japan.
After the asset price bubble collapsed in the 1990s, the Money Lending Business Act was tightened. Maximum interest rates fell under the Interest Rate Restriction Act, and total volume regulations (Soryo Kisei) capped consumer borrowing at one third of annual income. Commercial and regional banks responded by moving heavily into consumer card loans and free loans. But they had none of the things that dedicated consumer finance companies (Sarakin) had spent years building: granular credit scoring models, fast automated underwriting engines, and a specialized collections operation for distressed debt. The industry settled on outsourced guarantees.
Here is how it works in practice. A regional bank markets a branded credit product to its depositors, such as the Bank of Yokohama Card Loan or a Kansai Mirai Bank free loan. Behind the scenes, the bank hands credit risk assessment and the default guarantee to SMBCCF. When a borrower defaults, SMBCCF pays the bank the outstanding principal and accrued interest, a step known in Japanese banking as subrogation (Daii Hensai). SMBCCF then holds the legal right to collect the debt from the borrower directly.
Because SMBCCF carries the financial liability on every loan it underwrites, its guarantee system cannot run on tokenized or anonymized metadata. It has to take in, validate and keep the full identity and financial file of each applicant. SMBCCF also hosts and operates the white-labeled web application forms that customers use to apply for these bank loans, which saves smaller regional banks and credit unions (Shinkin banks) from building their own digital onboarding. The Promise consumer lending platform runs on a separate infrastructure stack and was not affected by the November 2 intrusion. The partner guarantee environment is a different matter: it works as a large central clearinghouse sitting at the intersection of nearly two hundred domestic financial institutions.
The attack surface: guarantee administration and web application forms
The Bank of Yokohama (headed by President Tatsuya Kataoka) filed its disclosure on November 5, and Resona Group followed on November 6. Both say the compromised environment covered the guarantee administration system and the web application forms SMBCCF provides to partner banks.
In a multi-tenant financial hosting setup of this size, the presentation layer accepts HTTP or HTTPS POST requests carrying applicant form data and validates session tokens. It passes structured payloads to an application server cluster, which writes records to a backend relational database and triggers automated credit bureau queries to the Japan Credit Information Reference Center (JICC) and the Credit Information Center (CIC).
When SMBCCF shut down access to the guarantee system on November 2, the web intake forms and partner underwriting portals went offline with it. The Bank of Yokohama, Ehime Bank and Tsukuba Bank, which paused applications for its Asjoy card loan, all had to suspend new online loan originations.
📬 Stay Ahead of Cyber Threats
Get the latest cybersecurity news, critical vulnerabilities, threat intelligence, tutorials, and exclusive giveaways delivered straight to your inbox. No spam. Unsubscribe anytime.
Subscribe to the Newsletter →The sequence in the Bank of Yokohama’s disclosure is useful for incident responders. After the November 2 containment, SMBCCF first told the bank that no leakage of personal data had been confirmed. That kind of early all-clear is common when defenders find an active web shell, an exploited application vulnerability or odd authentication events, and disconnect before they spot staging archives or bulk database dumps on the perimeter host. The later deep-dive correlated application execution logs, database query audit trails and network egress or proxy logs, and it showed that data had been sent out before containment. SMBCCF then retracted its earlier statement and notified partners on November 5.
What data was exposed in the breach
Across all the disclosures, SMBCCF confirmed that the affected records held up to fourteen data fields, which fall into three groups.
The first group is personal and contact information: full legal name, gender, date of birth, home address, home landline, mobile number, email address and the twelve-digit Japanese driver’s license number (Unten Menkyosho Bango). The second covers employment and underwriting details: employer name and workplace information, workplace telephone number and declared annual income. The third is contract and banking metadata: the four-digit financial institution code (Kinyu Kikan Kodo), the bank’s internal customer number (Kokyaku Bango), the guaranteed loan limit (Hoshogaku) and the guarantee start date (Hosho Kaishibi).
What was not exposed
SMBCCF and its partner banks verified that the image files used for identity verification were not taken. That covers scans or smartphone photos of driver’s licenses, My Number cards and residence certificates submitted during eKYC onboarding. Bank account numbers, cash card PINs and online banking passwords were not in the compromised environment either.
The architecture explains both. In loan origination systems, structured text data lives in high-performance relational tables, where fields such as the financial institution code and customer number work as composite or foreign keys that separate one bank’s records from another’s. Unstructured KYC images are normally kept in separate object storage or document management servers with their own identity and access management policies and network paths. Disbursement accounts and core banking authentication sit inside each bank’s own core system (Kanjokei Shisutemu) and never cross the API boundary into the guarantor’s underwriting database. So the attacker had read and egress access to the relational database holding applicant and contract tables, but did not take over the wider domain, the separate storage arrays or the partner banks’ networks.
Resona Group and the 25-year data tail
Digital-first banks saw large exposures of active portfolios. Docomo SMTB Net Bank disclosed on November 5 that up to 122,635 card loan customers might be affected, more than a third of the 320,118 ceiling. The joint disclosure from the three Resona Group banks on November 6 shows a different problem, which is how old data lingers after mergers and ended vendor contracts.
Resona Bank (President Kazuhiro Chida), Kansai Mirai Bank (President Shogo Harato) and Minato Bank (President Hideki Mochimaru) said in their joint notice that their current loan application systems were not disrupted, because their guarantee partnership with SMBCCF belonged to the past. All 5,935 Resona Group customer records taken in the breach belonged to former borrowers whose loan contracts had already been fully terminated and closed.
The contract windows in the disclosure show how bank consolidation leaves old data behind in third-party systems:
- Resona Bank: 139 former customer records, all from card loan contracts handled between April 2, 2001, and December 31, 2005, by the former Nara Bank (Kyu-Nara Ginko), which merged into Resona Bank in January 2006.
- Kansai Mirai Bank: 5,793 former customer records, covering card loans originated between October 1, 2002, and October 14, 2019, and free loans handled between January 28, 2005, and June 18, 2010. These accounts came through the former Kinki Osaka Bank (Kyu-Kinki Osaka Ginko) and Kansai Mirai Bank, which was formed in April 2019 by the merger of Kinki Osaka Bank and Kansai Urban Banking Corporation.
- Minato Bank: 3 records, tied to card loans active between March 12, 2021, and July 31, 2026, and free loans from February 24, 2012, to July 31, 2026.
The picture was messier at the Bank of Yokohama (part of the Yokohama Financial Group) and at smaller regional lenders such as Sanju-San Bank, which confirmed 914 affected customers on November 6, Toyama Bank and Tottori Bank. In its November 5 notice, the Bank of Yokohama said it had confirmed that its customers’ personal data was in the stolen payload from the guarantee systems for the Bank of Yokohama Card Loan and Bank of Yokohama Free Loan. It had not yet determined which fields were affected per customer or how many people were involved, and it was waiting on SMBCCF’s forensic analysis.
Why 2001 records were still online in 2026
Former Nara Bank records from April 2001 were sitting in a live, internet-connected production database in November 2026. That is a serious failure of data lifecycle governance and storage tiering.
Japanese law does require financial institutions to keep closed contract histories, but not for anything like 25 years. The Commercial Code sets a ten-year retention period for commercial books and transaction records. The Act on Prevention of Transfer of Criminal Proceeds requires seven years of retention for KYC verification records after a contract ends, and tax accounting rules add their own requirements. Even under the most conservative reading of the limitation period for civil credit claims or regulatory audit lookbacks, nothing justifies keeping terminated loan records from 2001 to 2005 online in a production environment wired to external web interfaces.
When Nara Bank merged into Resona Bank in 2006, and when Resona Group later wound down those guarantee arrangements with SMBCCF, the old records were neither purged once the retention windows expired nor moved to air-gapped, encrypted cold storage. They stayed in hot tables next to active underwriting data until an attacker ran an unthrottled query across the database.
Fraud risks: why this dataset is dangerous
SMBCCF and its partner banks have stressed that no secondary financial damage has been confirmed. They also point out that without bank account passwords, cash card PINs or driver’s license photos, unauthorized fund transfers are not immediately possible. From a threat intelligence view, that downplays the dataset. In the East Asian underground, a record like this is a high-precision credit dossier (Shinyo Joho Meibo).
The four-digit institution code (0010 for Resona Bank, 0138 for the Bank of Yokohama, 0159 for Kansai Mirai Bank, 0168 for Minato Bank, 0038 for Docomo SMTB Net Bank) is paired with the exact guarantee limit, the guarantee start date, declared annual income and the employer’s phone number. That combination is far more useful to criminals than a generic credential or spam list.
Driver’s license numbers and knowledge-based authentication
A twelve-digit driver’s license number exposed alongside a full name, date of birth and address breaks a static authenticator that non-bank financial services, telecom carriers and credit bureaus all rely on. The number is not random. The first two digits identify the issuing Prefectural Public Safety Commission, and the third and fourth give the year of first issuance. The middle six digits are an administrative serial number protected by a Modulo-11 check digit, and the last two record how many times the license has been reissued after loss or theft.
An attacker cannot pass a live biometric eKYC check without the physical card or an image of it. Knowing the exact string still helps in several ways. Fraudsters can pass knowledge-based authentication questions on telephone support lines, forge cards with valid checksums that get through automated OCR validation, and match victims against other breached databases.
Tokushu Sagi and voice phishing
Workplace phone numbers, employer details, annual income and exact loan guarantee amounts give fraudsters a strong pretext for voice phishing, known in Japan as Tokushu Sagi (special fraud). Imagine a caller who reaches a victim’s mobile phone or workplace switchboard posing as the risk management division of the Bank of Yokohama or Resona Bank. The caller states the exact date the victim opened a card loan in 2014, the credit limit in yen and the salary registered at underwriting. Most people’s skepticism disappears at that point.
With that credibility, attackers can send SMS links to lookalike domains, using the leaked mobile numbers and email addresses, and harvest online banking credentials, one-time passwords and cash card PINs in real time. For higher-income people in the dataset who once took out consumer card loans, there is also a risk of targeted extortion or predatory refinancing offers. Social stigma around consumer loans remains strong in Japan, especially when a workplace contact number is involved.
Regulatory pressure on Japanese banks and outsourced vendors
The breach lands as Japan’s Financial Services Agency (FSA) and Personal Information Protection Commission (PPC) are showing little tolerance for lapses. Over the past two years the FSA has revised its Comprehensive Guidelines for Supervision of Major Banks and its operational resilience frameworks, with a focus on third-party vendor concentration risk after a run of supply chain compromises at Japanese companies.
Under Article 24 of the Banking Act and the Act on the Protection of Personal Information (APPI), outsourcing credit underwriting or loan guarantee processing does not shift legal liability away from the originating bank. Every affected institution, from megabank affiliates to small regional lenders, stays accountable for continuous auditing and technical supervision of its outsourced contractors (Itakusaki).
Three security failures every financial CISO should address
The SMBCCF incident points to three engineering problems that shared financial ecosystems need to fix.
1. Monolithic multi-tenant database schemas
Keeping underwriting records for 189 financial institutions in one shared relational environment is hard to defend. A single compromised application credential or SQL injection path can read across multiple financial institution code partitions. Guarantee providers should enforce cryptographic tenant isolation with per-tenant encryption keys managed in hardware security modules (HSMs), plus row-level security policies tied to scoped, short-lived service tokens. An intrusion through one partner bank’s web form should never be able to query or dump another institution’s records.
2. Public web intake wired to historical underwriting stores
The link between internet-facing application forms, such as those SMBCCF hosts for the Bank of Yokohama and regional partners, and the backend database of historical guarantee contracts let an external attacker reach deep into archived records. Public loan portals should sit in an isolated DMZ as stateless ingestion queues. They should write encrypted payloads to an asynchronous message broker that has no connection to the internal underwriting databases where historical customer records are stored.
3. Manual data retention that fails after mergers
The exposure of 25-year-old Nara Bank records and 20-year-old Kinki Osaka Bank contracts shows that manual retention policies break down during bank mergers and system migrations. Financial databases need automated, policy-driven time-to-live (TTL) rules and crypto-shredding. Once a loan contract ends and its seven-to-ten-year retention period under Japanese law runs out, the personally identifiable attributes (name, address, driver’s license number, phone number and employer data) should be irreversibly purged or replaced with anonymized hashes in the production database. Only aggregated statistics for actuarial modeling should remain.
Support lines and what affected customers can do now
SMBCCF has opened two emergency toll-free consultation lines, 0120-362-167 and 03-5677-9228, and is working with partner banks to send individual notifications by email and SMS. A call center cannot undo the exposure of 320,118 financial profiles, though. Regional banks across Japan are now auditing their third-party guarantee pipelines, and many are still working to restart the loan originations they halted on November 2.
