Up to 9,086 Marui customers' information leaked... digital securities consignment company breached

Marui Group disclosed that personal data for up to 9,086 customers, along with information on corporate bond buyers using NTT DATA's digital securities service, was exposed through a breach of Securitize Japan's platform. The intrusion occurred on October 29 in Securitize Japan's software-as-a-service system, where NTT DATA said a vulnerability in authentication features was exploited to improperly obtain administrative privileges and exfiltrate data. NTT DATA flagged the possible leak on October 31 and confirmed data exfiltration on November 2, with the cause and full scope still under investigation. Marui Group said on November 2 that it would contact affected digital bond application account holders. The incident matters because it ties a major Japanese retailer's customer data to the security of a third-party digital securities platform, and the next thing to watch is the scope of the investigation and whether other Securitize Japan clients were affected.