The Japanese arm of Saxo Bank was hit by cybercriminals two months ago with the personal data of a 'limited number' of customers compromised. Saxo Japan first discovered it was the subject of a customer data breach on July 16 after hackers targeted a client relationship management system (CRM) that the company outsourced from a third-party vendor.
According to a statement translated from its Japanese website, Saxo Bank Securities Co., Ltd. provided more details of its ongoing investigation into the matter, revealing the types of personal data that may be affected. The broker confirmed the breach included clients’ names, contact details, date of birth, bank account information, and identity verification documents.
Although the company suspended the access of the external service provider and shut down all connections to the hacked server, which Saxo said it stored data on 38,026 people, the miscreant stole the personal information of 750 clients.
As a precaution, the Japanese firm has permanently migrated all the functionality provided by the external CRM database to an equivalent system managed by its parent, Saxo Bank Group. Further, Saxo enabled two-factor authentication in all accounts and told clients to change their passwords.
Customers of the broker have subsequently been approached in a phishing exercise by the cyber crooks. As such, Saxo Japan’s clients were asked to contact their local cybercrime and consumer protection agencies if they believe their personal information has been compromised. Clients were further advised to consult with their banks immediately if they sent money or provided confidential banking information to any potential scammers in general.
The Company’s Statement Further Reads:
“Around 6 am on July 14, 2020, a server that stores deposit and withdrawal tools developed for us by an external vendor was illegally accessed by a third party, and around 10:30 pm on Wednesday, July 14, 2020. Our employees have realized that the personal information of our customers may have been leaked. We received the file taken out from the head office around 2:00 am on Wednesday, July 15th, and then confirmed that the information stored in the file belonged to our customer. At around 4:40 am on the same day, the server related to this matter was shut down and access from the outside was completely blocked.”
Once Saxo became aware of the issue, the company engaged as a matter of urgency with their respective data privacy regulators and independent external forensic experts to conduct an extensive investigation.
However, the broker said none of its trading systems, customers’ trading account credentials or login passwords to SaxoTrader PRO and SaxoTraderGo were compromised or at risk, as a result of the incident.
Based in Tokyo and licensed by the Financial Services Authority, Saxo Bank Securities is a subsidiary of Danish Multi-Asset broker Saxo Bank. The branch provides Online Trading and investment tools to both retail and institutional clients.
