A hack of the loan-guarantee system run by SMBC Consumer Finance, one of Japan's biggest consumer lenders, has leaked personal and loan data belonging to as many as 320,118 people, the company has disclosed, in a breach that has spread across the country's banking sector because the same system served 189 partner financial institutions.
The company, the consumer finance arm of Sumitomo Mitsui Financial Group and the operator of the Promise lending brand, said the unauthorised access was first detected on Monday 2 November, when unusual activity was spotted on the systems that power its credit guarantee business. Access to the guarantee system was cut off the same day. At first, partner banks were told that investigators had not confirmed any loss of personal data, but as responders rebuilt the timeline from traffic logs they found that an unknown party had queried records and sent them out of the system.
SMBC Consumer Finance publicly announced the breach on Thursday 5 November. Its guarantee business sits behind card loans and other personal loans sold by other lenders: when a customer borrows from a partner bank, SMBC Consumer Finance underwrites and guarantees the loan, taking on the credit risk. As of March 2026 it had 189 partner institutions, including regional banks, shinkin banks and online banks, which is why a single intrusion has produced disclosures from lenders all over Japan.
None of the partner banks says its own systems were broken into. Their core banking networks were untouched; the exposure came from the shared guarantee platform, where loan applications and guarantee histories from many institutions were processed in one place. The incident is a clear example of how one weak point at a shared service provider can become a problem for an entire network of banks at once.
The records that may have leaked cover up to fourteen fields of data. They include full names, gender, dates of birth, home addresses, landline and mobile phone numbers and email addresses, along with the twelve-digit Japanese driving licence number. They also include employment details such as the employer's phone number and the customer's annual income, and contract information including the institution code, customer number, guaranteed amount and the date the guarantee began. The company says the image files used for identity verification were not taken.
The single biggest share disclosed so far belongs to Docomo SMTB Net Bank, the online bank formerly known as Sumishin SBI Net Bank, which said up to 122,635 of its card loan customers may be affected, more than a third of the overall ceiling. The Bank of Yokohama filed its disclosure on 5 November. On 6 November the Resona group confirmed that three of its banks, Resona Bank, Kansai Mirai Bank and Minato Bank, had about 5,935 files on former customers caught up in the incident, most of them linked to card loans that had already been closed. Regional lenders including Ehime Bank, Tsukuba Bank, Eighteenth Shinwa Bank, San-in Godo Bank affiliates, Tajima Bank, Toyama Bank and Tottori Bank have also confirmed that customer records were involved.
The headline figure of 320,118 is a maximum, not a confirmed count of people whose complete files left the company. Not every affected record contains every field, and the numbers published by individual banks are parts of that one total, not separate attacks added together. Some of the records relate to former customers and to loans taken out years ago, which means many people affected may never have dealt with SMBC Consumer Finance directly; their own bank's name is the one they will recognise.
SMBC Consumer Finance has suspended the guarantee system while safety checks and maintenance continue, and has opened emergency consultation lines for worried customers. It says people confirmed to be affected will be notified individually, by email or text message, in coordination with the partner banks, once the scope is pinned down. So far there is no confirmed sign of the leaked data being used for fraud, although data of this kind, real loan amounts, incomes and licence numbers, is exactly what telephone and message scammers use to sound convincing.
The breach caps a difficult week for data security in Japan's financial sector. Days earlier, a separate intrusion at Securitize Japan, a contractor used for digital securities, exposed customer information held for Sony Bank, NTT Data and Marui Group, and Sony Bank suspended its digital securities service. Financial groups everywhere are being reminded that outsourcing a system does not outsource the risk: customers hold their own bank responsible, whatever company was running the platform behind the scenes.
How the attackers got in has not been disclosed, and the company has not identified who was behind the intrusion. The investigation into the entry point and the full reach of the access is continuing, and more partner institutions may still publish their own figures, which could change the picture of how many customers each bank has in the total. Customers of Japanese banks who receive calls or messages quoting their real loan details are being advised to treat them with caution and to contact their bank through official channels.
Figures in this post were checked against company and partner-bank disclosures at about 8:05 pm Pakistan time on 7 November 2026.
This post is market news information only, not financial advice.
