Japan's SMBC Consumer Finance reports data breach affecting up to 320000 customers ...

SMBC Consumer Finance (formerly Promise) announced on November 5 that a third party gained unauthorized access to the system used for its guarantee operations for card loans and other products, with customer data for up to 320,118 people transmitted externally. The information that may have leaked includes basic details such as names, addresses and phone numbers, as well as sensitive data including driver's license numbers, employers, annual incomes and guaranteed amounts (borrowed amounts).

The company is a major consumer finance firm under Sumitomo Mitsui Financial Group (FG) and provides card loan guarantee services in partnership with regional banks, shinkin banks, internet banks and others. As of March 2026, it had 189 partner financial institutions.

The unauthorized access was detected on November 2. Access to the guarantee business system was blocked the same day, and the data leak was confirmed during an investigation into whether any other suspicious communications had occurred. Details of the attack method and cause have not been disclosed at this point. The company is working with experts and relevant parties to quickly identify the cause and scope of impact.

The leaked data spans a wide range of categories. Basic information includes names, gender, dates of birth, addresses, and mobile phone numbers, and email addresses. Identity verification-related data includes driver's license numbers, though license images themselves were not leaked, according to the company. Employer-related information includes workplace phone numbers and annual incomes, while contract information includes financial institution codes, customer numbers, guaranteed amounts and guarantee start dates.

Docomo SMTB Net Bank (formerly Sumishin SBI Net Bank), one of the partners, said the same day that up to 122,635 of its customers may have had their information leaked. That single bank accounts for roughly 40% of the total, illustrating how the breadth of the partner network has widened the scope of the damage.

Note: The number of affected individuals and partner institutions are based on figures disclosed by the company and its partners.

The company has suspended the guarantee system and is continuing safety checks and necessary maintenance. After identifying the scope of affected customers, it plans to notify them individually by email or SMS in consultation with its guarantee partners. No secondary harm such as misuse of the information has been confirmed so far, but the company is warning that suspicious phone calls, emails or SMS messages claiming to be from the company or financial institutions may be sent. It urges anyone receiving unexpected communications not to access any URLs or enter personal information, and to consult its dedicated hotline (03-5677-9228) or police.

The company said it "takes this matter seriously" and will work to prevent recurrence and strengthen its information management system.

The incident demonstrates that even when a financial institution's own systems are secure, sensitive information such as customers' annual incomes and borrowing amounts can leak through the outsourced guarantee business channel. As more lenders offer card loan application forms through partners, the case has highlighted anew a structure in which the security posture of guarantee companies affects customer protection at partner financial institutions.

In the financial industry in recent years, data leaks originating from outsourcing contractors and group companies have occurred one after another. In this case, individual notifications and fraudulent communications could arrive through the same email or SMS channels, making it difficult for customers to tell them apart — a new challenge. Partner banks face accountability to customers even if their own systems are unaffected. Each bank is expected to move forward with identifying the scope of affected customers and preparing notices.

The market is likely to focus on the need to strengthen governance over information management. Sumitomo Mitsui FG is in the midst of accelerating its digital strategy, and investors may pay closer attention to the group's personal data protection framework. Attention is also on whether Japan's Financial Services Agency will move to assess the actual state of outsourcing management for guarantee operations, including those involving institutions other than deposit-taking financial institutions.