Threat intel
SMBC Consumer Finance breach hits banks' loan customers
A break-in at the guarantor behind many Japanese bank card loans exposed up to 320,118 customers. What leaked, why it spread, and what lenders should check.
SMBC Consumer Finance, the Sumitomo Mitsui Financial Group lender best known for its Promise consumer loans, said on November 5 that an outside party had broken into the system it uses to guarantee card loans for other banks and sent data out of it. Up to 320,118 customers are affected. The company detected the intrusion on November 2, cut off access to the system the same day, and found the data transfer while checking for other unauthorized access. The guarantee system is still suspended.
Most of the people in that count never borrowed from SMBC Consumer Finance directly. They took a card loan from a regional bank, a shinkin bank (a cooperative regional lender) or an internet bank that pays SMBC Consumer Finance to guarantee the loan and, for some partners, to run the web application form. Docomo SMTB Net Bank said up to 122,635 of its card loan customers are among them. If your organisation hands customer records to a guarantor, a loan servicer or any outside processor, this incident is a worked example of what that arrangement can cost. It is a separate incident from the email leak at Sumitomo Mitsui Banking Corporation, the group's bank.
How a guarantor ends up holding everyone's data
In Japan, banks commonly have an unsecured card loan guaranteed by a consumer finance company. The guarantor screens the applicant, sets or approves the limit, and repays the bank if the borrower defaults. To do that it needs the full application: identity, contact details, employer and income, and the loan terms. SMBC Consumer Finance's corporate profile lists 189 guarantee partners, so one system holds the application and contract records of customers from many unrelated banks.
Docomo SMTB Net Bank and Hokuyo Bank both stress that their own systems were not accessed. Their customers' records still sat in the guarantor's database, outside each bank's controls, logging and incident response.
The notice lists the fields shown in the diagram above: identity and contact details, the driver's licence number, employer and annual income, and the contract record with the bank code, customer number and guarantee amount. Images of driver's licences and other identity documents were not included. The count is a maximum, and the partner banks say not every item applies to every customer.
Why licence number plus income is useful to a fraudster
Beyond name, birth date and address, this set gives a caller three things that make a scam convincing. The financial institution code and customer number tell a caller exactly which bank the victim borrows from and how that bank refers to them. The guarantee amount and start date let them describe the victim's own loan. The employer phone number and annual income let them pose as a lender offering a refinance or a limit increase that sounds tailored, or as the employer's payroll office.
The driver's licence number is the field people tend to underestimate. It is collected on loan applications exactly like these, and a caller who reads it back to a victim sounds like a real bank checking records. Combined with the rest, it helps fill in a credit or account application in the victim's name. The missing licence images limit this: services that verify identity with a photo of the licence or a read of its IC chip need the card itself. Applications and checks that take the number alone are the exposure.
Hokuyo Bank's notice warns that leaked data may be used for suspicious contacts and phishing emails, and tells customers not to enter account details or PINs in reply to messages claiming to come from the bank, the guarantor or related companies.
What is known about the attack
Very little has been published. SMBC Consumer Finance has not said how the attacker got in, which component was exposed, whether ransomware was involved, or where the data was sent. It is investigating with outside specialists and will notify affected customers by email or SMS once it has worked out who they are, coordinating with each partner bank. As of November 5 it had seen no secondary harm.
The banks' own notices fill in the scope. Docomo SMTB Net Bank, formerly SBI Sumishin Net Bank, gave its figure of up to 122,635 card loan customers on November 5. That number sits inside the guarantor's 320,118, so the two must not be added together. Daishi Hokuetsu Bank said up to 1,307 customers of its Benrina 365 loan are affected, all of whom applied on or before September 30, 2020; the product stopped taking applications on October 1, 2020. Records from a loan closed to new business six years ago were still in the guarantor's system. Hokuyo Bank stopped new applications and limit increases for its Super Alka card loan until the guarantor's system is confirmed safe.
What customers should do
If you hold or applied for a bank card loan in Japan, check your bank's notices and wait for the guarantor's individual email or SMS before assuming you are not affected. That notification is itself a phishing lure to watch for: open the bank's site or app yourself rather than following a link.
- Treat any call about your card loan, limit or refinancing as unverified, however much the caller knows. Hang up and call the number printed on your card or contract.
- Do not give a PIN, one-time code or online banking password to anyone by phone, SMS or email.
- Watch for credit applications or new accounts you did not open. A credit report from CIC or JICC, the main consumer credit bureaus, shows new inquiries.
What lenders and fintechs relying on a guarantor should do
Map what each third party holds. For every guarantor, servicer, credit bureau link and application form provider, write down which customer fields you send, by which channel, and how many records the provider holds today, including closed and rejected applications. Several banks in this incident could only say "under investigation" when they posted their first notice, because the answer sat with the guarantor.
Send fewer fields. Ask whether the guarantor needs the full licence number after screening, or only a verification flag and the last digits. The same question applies to email addresses and home phone numbers once a loan is live. Every field you stop sending is one you never have to notify about.
Set retention in the contract and test it. The Daishi Hokuetsu records show how long data outlives the product. Require deletion of rejected applications and closed accounts after a fixed period, ask for written confirmation of each purge, and include it in your annual vendor review.
Write notification into the contract. Specify how many hours after detection the processor must tell you, what the first report must contain (affected fields, record counts per partner, whether data left the network), and who notifies customers. Japan's Act on the Protection of Personal Information requires certain leaks, including those affecting more than 1,000 people, to be reported to the Personal Information Protection Commission, so you need the facts fast even when the breach is at the vendor.
Have the customer playbook ready. Prepare the notice, a call script for your contact centre and a list of the questions your staff will never ask by phone. Flag affected customers so that limit increases, address changes and new devices on their accounts get a manual check for the next few months, and watch your fraud queue for applications that reuse leaked licence numbers with new contact details.
If you want help mapping which vendors hold your customer data and what your contracts actually require of them, our compliance and audit readiness team does this work, and security operations can set up the fraud and account monitoring. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: SMBC Consumer Finance announcement, November 5, 2026 (PDF), Docomo SMTB Net Bank notice, Hokuyo Bank notice (PDF), Daishi Hokuetsu Bank notice, SMBC Consumer Finance corporate profile (PDF), Asahi Shimbun via Yahoo News Japan, Jiji Press, SmartScope, SBBIT, Security Measures Lab on Docomo SMTB, Security Measures Lab partner bank roundup.