A cyberattack on a third-party email service exposed 227,216 email addresses used by Sumitomo Mitsui Banking Corporation (SMBC).
The bank uses the service, operated by Arara Inc., mainly to send emails to corporate customers and some sole proprietors.
The leaked email addresses belonged to recipients of SMBC emails sent between 1 July and 31 October 2026.
The exposed information did not include account numbers, deposit balances, PINs or online banking login credentials.
SMBC first learned of the unauthorised access on 28 October, but an initial investigation found no evidence of a leak.
The bank is working with Arara to establish how the breach occurred and assess its full impact.
SMBC warned customers about suspicious messages impersonating the bank or other organisations.
It advised them not to click on suspicious links or share sensitive banking information.
Customers in Japan can contact a dedicated helpline, while those overseas can seek assistance from their relationship managers or customer service teams.
Featured image: Edited by Fintech News Singapore, based on image by designer vibe via Magnific
Source link







