SMBC data breach exposes 227,216 customer email addresses - Asian Banking & Finance
Sumitomo Mitsui Banking Corporation (SMBC) has confirmed that 227,216 customer email addresses were leaked following an unauthorised third-party intrusion.
The breach originated from "Arara message," an email distribution service provided by Arara Inc. and primarily utilised by SMBC to send messages to corporate customers and certain sole proprietors. SMBC was first informed of unauthorised access by Arara Inc. on Wednesday, 28 October 2026, though initial system log reviews indicated no data leakage at that time.
A subsequent report on Monday, 2 November 2026, confirmed that email addresses had indeed been compromised. The leaked data is strictly limited to email addresses of recipients who received messages from SMBC between 1 July and 31 October 2026.
Financial information unaffected
Financial information, including bank account numbers, deposit balances, PINs, internet banking login IDs, and passwords, remains unaffected. The bank is continuing its investigation with Arara Inc. and will report the incident to relevant authorities.
Customer response measures
SMBC has issued a warning advising customers to remain vigilant against potential phishing attempts or suspicious communications impersonating the bank. A dedicated customer helpline has been set up in Japan, operating from Thursday, 5 November 2026 to Monday, 30 November 2026, on weekdays between 9:00 a.m. and 5:00 p.m.
Customers outside Japan are advised to contact their regular relationship manager or customer service team for further assistance.
Related
