SMBC Consumer Finance disclosed on November 5 that an intruder had accessed a system used to support loan-guarantee work for banks and other financial institutions. The company said it detected unauthorised access on November 2, blocked access that day and later confirmed that data had been sent outside the system. Its maximum estimate was 320,118 people. By the following morning, banks across Japan were issuing notices to customers, exposing how a breach at one specialist provider can travel through a much wider financial network.

A breach inside the guarantor, not the banks

SMBC Consumer Finance is an SMBC Group company that operates the PROMISE lending brand. The compromised environment was described separately as a system used for guarantee operations. That distinction matters. The disclosure does not say that the Promise app, the group's core banking systems or every partner bank's own network was penetrated. It identifies unauthorised access to the guarantor's system and data sent out from it.

SMBC Consumer Finance said it detected the access on November 2 and cut off access to the guarantee system the same day. During its investigation, it found that outbound data included customers' personal information. The company announced the breach on November 5, said it was still investigating the cause and the full scope, and temporarily suspended the guarantee system while it checked security and carried out necessary maintenance. It did not identify an attacker or explain the initial route into the system in the public notice.

Sources: 当社保証システムへの不正アクセスによるお客さま情報の漏えいについて · Finance Business · Message from President · ＳＭＢＣコンシューマーファイナンス（保証提携先）への不正アクセスによる当社カードローンのお客さま情報の漏えいについて · ＳＭＢＣコンシューマーファイナンス株式会社への不正アクセスによるお客さま情報の漏えいについて · SMBCコンシューマーファイナンス、保証業務のシステムに不正アクセスを受け、最大約32万人の年収や保証額を含む個人情報が漏えい

The exposed fields reach beyond contact details

The disclosed categories include names, gender, dates of birth, residential addresses, home and mobile telephone numbers, email addresses and 12-digit Japanese driver's licence numbers. The records may also contain employer information, including workplace telephone numbers and annual income, alongside contract details such as the financial institution code, customer number, guaranteed amount and the date a guarantee began. These are not merely details for contacting a borrower: combined, they can help a fraudster construct a convincing picture of a person's identity, employment and borrowing history.

SMBC Consumer Finance said images of driver's licences and other identity documents were not included. That is a meaningful limit, but it does not make the exposed licence numbers or income data harmless. The headline figure is a maximum, not a claim that every person had every listed field in one complete record; the company has not published a field-by-field breakdown. The number should therefore be read as the upper bound it is: the exact records and information attached to each individual remain part of the investigation.

Sources: 当社保証システムへの不正アクセスによるお客さま情報の漏えいについて · ＳＭＢＣコンシューマーファイナンス（保証提携先）への不正アクセスによる当社カードローンのお客さま情報の漏えいについて · ＳＭＢＣコンシューマーファイナンス株式会社への不正アクセスによるお客さま情報の漏えいについて · SMBCコンシューマーファイナンスが不正アクセスを受け最大32万118人分の情報が漏えい · 運転免許証の番号等の形式及び内容について（通達）

Why 189 partners change the scale of the story

Loan guarantees are a behind-the-scenes part of consumer lending. A customer applies to a bank or another lender for an unsecured personal loan. The financial institution conducts its own screening, while SMBC Consumer Finance, acting as guarantor, performs a separate guarantee assessment. If the borrower later cannot repay, the guarantor reimburses the lender under the guarantee arrangement. The bank remains the lender and the customer's visible relationship may stay with that bank, even though a specialist provider handles important parts of the application and credit-risk process.

SMBC Consumer Finance's corporate website listed 189 partner financial institutions to which it provided loan guarantees as of March 31, 2026. The company's English description says its Tokyo and Fukuoka guarantee centres handle application reception and guarantee screening for partner institutions' unsecured personal loans. The 189 figure describes the reach of the guarantee business, not 189 confirmed victims or a list of institutions whose data was all taken. But it shows why a shared provider can become a concentration point: one compromised service may expose records originating from relationships spread across many separate lenders.

Sources: Solution Business · Finance Business · Message from President

Banks are reporting one shared incident, not 14 separate hacks

By the morning of November 6, a Japanese security-industry roundup had identified at least 14 banks that had publicly acknowledged a possible or confirmed connection to the incident. The notices did not all say the same thing. Some banks confirmed that customer information was present in the data sent outside the system; others said they were checking whether their customers were affected or warned that exposure was possible. Treating every notice as a completed confirmation would overstate what was known at that point.

The disclosures also show why the bank-level figures must not be added to the 320,118 maximum. DOCOMO SMTB Net Bank said up to 122,635 of its card-loan customers could be within scope. Resona Bank reported 139 former customers, Kansai Mirai Bank 5,793 and Minato Bank three, all linked to closed loan contracts. These are institution-specific subsets of the wider incident, not additional populations to stack on top of SMBC's ceiling. Bank of Yokohama also reported that its guarantor had been affected, while its own customer count remained unknown in the reporting available at the time.

Sources: ＳＭＢＣコンシューマーファイナンス（保証提携先）への不正アクセスによる当社カードローンのお客さま情報の漏えいについて · ＳＭＢＣコンシューマーファイナンス株式会社への不正アクセスによるお客さま情報の漏えいについて · SMBCコンシューマーファイナンスへの不正アクセスによるサイバー攻撃のまとめ-提携14銀行に波及、各銀行が個人情報漏洩の恐れを通知 · SMBCコンシューマーファイナンス、保証業務のシステムに不正アクセスを受け、最大約32万人の年収や保証額を含む個人情報が漏えい · Japan's SMBC Consumer Finance hacked, Resona and Bank of Yokohama hit

The disruption is spreading into lending operations

The immediate consequences are not confined to privacy notices. Because the guarantee system supports loan applications and screening, its suspension has affected some partner banks' ability to accept or process applications. Chugoku Bank said it had stopped web applications for two loan products that relied on the system until safety and stable operation could be confirmed. Suruga Bank likewise said new applications for loan products using the guarantor were suspended. Other institutions said applications could continue but that screening might take longer, showing that the operational effect differs by bank and product.

Banks have also warned customers to be alert for calls, emails or text messages that exploit the incident. As of the November 5–6 notices, SMBC Consumer Finance and several partner banks said they had not confirmed secondary harm arising from the breach. That is a time-specific status report, not proof that the stolen information cannot be misused later. The company said affected people would be contacted individually once the scope had been identified. Until then, customers should rely on official bank channels rather than links or requests arriving unexpectedly.

Sources: 当社保証システムへの不正アクセスによるお客さま情報の漏えいについて · SMBCコンシューマーファイナンスへの不正アクセスによるサイバー攻撃のまとめ-提携14銀行に波及、各銀行が個人情報漏洩の恐れを通知 · 保証業務委託先（ＳＭＢＣコンシューマーファイナンス株式会社）への不正アクセスによるお客さま情報の漏えいについて · 外部保証会社における不正アクセスにともなう個人情報の漏えいおよびWeb申込受付の一時停止について

The unanswered questions are about control as well as intrusion

The public record still leaves basic forensic questions open: how the intruder entered, how long access lasted, what systems or accounts were reached, and how the company determined which outbound records contained personal information. The initial announcement did not name a threat actor or an entry point. It also did not provide a final count by partner institution or explain whether the data left the system in one transfer or several. Those gaps should remain gaps in the story until investigators or the company provide evidence, rather than being filled with assumptions about ransomware, phishing or a particular vulnerability.

The governance question is what happens when a service provider holds sensitive records for customers of institutions that do not operate its systems. Banks can outsource guarantee screening, but they still need to understand what data is shared, why it is retained, who can access it, how quickly an incident can be contained and how customers will be told. The appearance of former borrowers among the affected records also raises questions about retention periods and deletion practices, without proving that any specific record should already have been erased. The breach's final scale may change; the concentration risk is already visible.

Sources: 当社保証システムへの不正アクセスによるお客さま情報の漏えいについて · Solution Business · ＳＭＢＣコンシューマーファイナンス株式会社への不正アクセスによるお客さま情報の漏えいについて · SMBCコンシューマーファイナンスへの不正アクセスによるサイバー攻撃のまとめ-提携14銀行に波及、各銀行が個人情報漏洩の恐れを通知 · SMBCコンシューマーファイナンス、保証業務のシステムに不正アクセスを受け、最大約32万人の年収や保証額を含む個人情報が漏えい · Japan's SMBC Consumer Finance hacked, Resona and Bank of Yokohama hit