SMBC Consumer Finance confirms loan-guarantee data theft affecting up to 320,118 customers
SMBC Consumer Finance confirms personal data was sent out of its loan-guarantee system. The upper bound is 320,118 customers. Exposed fields include driver's license numbers, income and loan-guarantee details. The company blocked access and suspended the system while it investigates.
- Disclosed
- Nov 5, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Customers whose loan or application data was handled by SMBC Consumer Finance's guarantee system for partner lenders.
- SMBC Consumer Finance · data breach · consumer lending
- In the wild
- Yes
- SMBC Consumer Finance confirmed unauthorized access and outbound personal data.
What happened
SMBC Consumer Finance guarantees loans for regional banks, credit unions and online banks, and provides web application forms to some partners. It confirmed that an intruder accessed the system used for that guarantee business and that personal data was sent outside it. The maximum of 320,118 customers is the guarantor’s estimate while it determines the final scope. Docomo SMTB Net Bank’s 122,635 maximum is part of that incident. The bank reports no confirmed unauthorized access to its own banking systems. Tsukuba Bank confirmed that its customers were among those affected and paused new applications for its Asjoy card-loan product.
The guarantor lists names, sex, dates of birth, addresses, home and mobile phone numbers, email addresses, driver’s license numbers, employment information such as work phone numbers and annual income, and contract information such as institution codes, customer numbers, guarantee amounts and start dates. The company excludes images of identity documents. Its November 5 notice reports no confirmed secondary harm as of publication. The entry method, final scope and a date for restarting the guarantee system remain unresolved in the notices.
Crime-scene timeline
Nov 2, 2026
Guarantor detects unauthorized access and blocks it the same day
SMBC Consumer Finance discovers the outbound transfer of personal data during its investigation.
Nov 5, 2026
Guarantor and partner banks disclose the incident
SMBC Consumer Finance gives an upper bound of 320,118 customers. Docomo SMTB Net Bank identifies up to 122,635 of its card-loan customers within that scope. Tsukuba Bank suspends new Asjoy applications.
Nov 6, 2026
Guarantor adds a toll-free customer line
The new number is 0120-362-167. The existing number is 03-5677-9228. Both operate daily from 09:00 to 18:00 Japan time.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- SMBC Consumer Finance November 5 incident disclosure (Japanese PDF)PrimaryConfirms the outbound transfer, personal data, maximum customer count, same-day access block and temporary suspension.
- SMBC Consumer Finance November 6 customer hotline updatePrimaryAdds a toll-free number and gives daily opening hours for both customer lines.
- Docomo SMTB Net Bank November 5 customer noticePrimaryGives the upper bound for its card-loan customers and reports no confirmed access to its own banking systems.
- Tsukuba Bank November 5 customer noticePrimaryConfirms that its customer data was involved and that it suspended new Asjoy applications.