SecurityNov 13, 2026, 2:19 PM UTC·2 min read

Monex Securities data breach: 1.13 million emails exposed

Monex Securities says an outside contractor's account-opening system was hit. Up to 1.13 million email addresses and 1,592 ID images may have leaked.

If you opened, or tried to open, an online account with Monex Securities in Japan since October 2019, your email address may be in the hands of a stranger. The company announced the Monex Securities data breach on 13 November.

According to Monex, an outside contractor that runs part of its account-opening system spotted attempted unauthorised access on 18 October. Monex cut off external access to the system the next day, 19 October, and has paused some account openings since. The investigation then found that some personal data may have leaked.

What data may have leaked?

Up to 1.13 million email addresses are affected. These are addresses entered as the very first step of an online application since 16 October 2019. The list includes duplicates and people who never finished opening an account.

The more sensitive part is 1,592 images of identity documents. They come from applicants who used the method that requires taking photos of their documents. Monex has not yet pinned down exactly whose images were taken, but the set includes the front of My Number cards, the front and back of driving licences, and selfies. My Number itself, the national ID number, has not been confirmed as leaked. Anyone who applied through the public digital authentication method using their My Number card is not affected.

Are existing Monex accounts at risk?

According to the company, no. The affected system is separate from the core system that holds account details, balances and trades, so logins and normal trading are unaffected. Account numbers, login passwords and trading passwords were not in the same database.

Monex says it will contact affected people individually. It has seen no reports of misuse or phishing so far, but it warns that suspicious emails or text messages claiming to be from Monex or another financial firm should be ignored: don't open the links, don't type in passwords and don't reply.

Apps worth a look

SUMO: the number puzzle

Tap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.

Dialo: learn languages by speaking

Talk to an AI conversation partner; every sentence comes back corrected and explained in your language. 9 languages, A1 to C2.

ediviewer: read EDI files like documents

Open EDIFACT and X12 messages, see every segment explained, convert to JSON/XML, export PDF and Excel. Runs locally, no upload.

giftdetect: the right gift in minutes

Pick who it is for, the occasion and their personality. The search engine reads product descriptions from local shops and ranks what fits. Free, no sign-up.

Tags:monex securitiesdata breachjapanidentity documentsphishing