SHINDO5

The Awa Bank, Ltd.

Total records (cumulative)at least27,000records

LEAK CONFIRMEDBank account / Postal addressUnauthorized access · Investigating

Open in the live monitor ▶
Disclosed
Apr 3, 2026
Detected
Mar 24, 2026
Detection to disclosure
10 days
Leak
Leak confirmed
Type
Unauthorized access
Status
Investigating
Security spend
Not checked yet
Compensation
Not announced

What leaked

Transactions & activityCorporate internet banking contract information, Transaction information
Account dataShareholder information
ContactAddress
Financial & paymentAccount-related information

Not leaked

  • PINs and passwords were not included

How many

  • Total records (cumulative) at least 27,000 records

Who is affected

  • Corporate internet banking clients
  • Shareholders
  • Customers and related parties

Cause

Unauthorized access to the test environment of an information-sharing system (cause under investigation)

Timeline

  1. Notified by an outside security company
  2. Leak confirmed that night
  3. First disclosure

Response

  • Blocked the entry point
  • Forensic investigation

Blocked access and took steps to prevent further damage; the overall scope and cause were still under investigation

What you should do

  1. Scammers who know your account number pose as refund staff. No bank or company asks for your PIN
  2. Watch for unexpected mail or invoices; your address is hard to change
  3. Check the company's notice to see if you're affected

Lessons for companies

  1. Don't keep ID or bank data: delete after checks or use a KYC provider
  2. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  3. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources