Rakuten Securities announced on October 31 that a total of 362 pieces of purchaser information for "digital bonus-attached corporate bonds" sold by the company may have been leaked due to unauthorized access to an external service. The company stated that Rakuten Securities' own systems were not subjected to unauthorized access.

The external service in question is used for applying for corporate bond bonuses and other related purposes. NTT DATA, the service provider, reported that a third party had gained unauthorized access to the "Digital Securities Platform" provided by NTT DATA's subcontractor, and that information may have been exfiltrated.

The affected parties include some customers who purchased Kagome's 1st Unsecured Corporate Bonds issued on February 21, 2023, and West Japan Railway's 80th Unsecured Corporate Bonds issued on June 19, 2024. For Kintetsu Group Holdings' 135th Unsecured Corporate Bonds issued on July 24, 2026, purchasers of ¥1 million or more are affected.

According to Rakuten Securities, login IDs, passwords, and various information necessary for transactions are not included in the potentially leaked data. As of the announcement, no unauthorized access or fraudulent transactions believed to be caused by this incident have been confirmed.

Regarding unauthorized access to the same external platform, JR West and Nomura Securities also successively announced their damages on October 31. JR West stated that for two pieces of investor information related to the 80th Unsecured Corporate Bonds, names, addresses, phone numbers, email addresses, genders, and dates of birth may have been leaked.

Nomura Securities also announced the possibility that purchaser information for digital bonus-attached corporate bonds, for which NTT DATA's subcontractor handles part of the customer management operations, may be affected. The number of affected cases and specific data items are currently under investigation, and the company stated that financial transaction information such as securities account numbers and passwords are not stored on that platform.