Short answer
SMBC Consumer Finance said on 5 November 2026 that a third party accessed the system it uses for card loan guarantee work and that data containing personal information was sent out of it. The company puts the number of people at up to 320,118 and says the cause is still under investigation.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | SMBC Consumer Finance |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Consumer finance |
| Country | Japan |
| Detected | 2026-11-02 |
| Disclosed | 2026-11-05 |
| People or records affected | Up to 320,118 people with card loans guaranteed through partner financial institutions |
What data was exposed
- Name, gender, date of birth and address
- Home phone number, mobile phone number and email address
- Driver's license number (images of ID documents were not included)
- Employer details including phone number and annual income
- Contract details: financial institution code, customer number, guarantee amount and guarantee start date
What happened
SMBC Consumer Finance announced on 5 November 2026 that a third party had accessed the system it uses for guarantee work on card loans, and that data sent out of that system included customers’ personal information. The company’s own notice says it detected the access on 2 November and blocked access to the system the same day. While checking for other unauthorized access, it then confirmed the leak.
Who is affected
The company works with regional banks, credit unions and internet banks to guarantee card loans, and for some partners it also supplies the web application form. That means affected people may know the lender only as their own bank. The notice puts the number at up to 320,118 people. Individuals will be notified by email or SMS after the range is fixed and after consultation with the partner institutions.
What data was involved
According to the notice, the items are name, gender, date of birth, address, home and mobile phone numbers, email address and driver’s license number. Employer information is also listed, including phone number and annual income, along with contract details such as the financial institution code, customer number, guarantee amount and guarantee start date. The notice says images of ID documents such as driver’s licenses were not included. Impress Watch reports the same list.
What is still open
The company says it is working with outside experts and the relevant authorities on the cause and the scope. Neither the notice nor Impress Watch describes how the attacker got in. We found no public claim by an attacker. As of 5 November no secondary damage had been confirmed. The guarantee system has been temporarily stopped while safety checks and maintenance continue.
The mix of income, employer and guarantee amount is the part that stands out. It lets a scammer write a message that sounds like a genuine loan matter. The notice itself warns of calls, emails and SMS that use the name of the company or financial institutions, and says not to open links or enter personal details in such messages.
Start with our data breach checklist. Lender impersonation is a close cousin of the tricks in urgent payment scams and phishing messages. Other incidents are on the breaches index.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Calls or SMS pretending to be SMBC Consumer Finance or your bank about a loan, guarantee or repayment problem.
- Fake debt collection or 'loan review' messages that quote your employer, income or guarantee amount.
- Phishing links that ask you to log in to a bank or loan page to 'verify' your account.
- Attempts to use a leaked driver's license number plus your date of birth to open accounts or pass identity checks.
What to do if you are affected
- 01If you hold a card loan from a regional bank, credit union or internet bank, wait for the company's notice by email or SMS and ignore unsolicited contact.
- 02Do not click links or enter personal details in messages that claim to be about this incident. Use the contact line in the official notice (03-5677-9228).
- 03Be careful with any request to confirm your driver's license number, and tell your financial institution if someone asks for it unexpectedly.
- 04Report suspicious calls or messages to the company's dedicated line or the police.
Frequently asked questions
How many people were affected?
The company's notice says up to 320,118 people. The figure is a maximum, and individual notification will follow once the range is fixed.
Was my driver's license image leaked?
No. The notice says images of identity documents such as driver's licenses were not included. The license number itself was among the data items.
I do not borrow from SMBC Consumer Finance. Could I be affected?
Possibly. The company provides guarantee services for card loans offered by regional banks, credit unions and internet banks, and for some partners it also provides the web application form. Affected customers will be told after consultation with those partners.
Has the data been misused?
The company said no secondary damage from this incident had been confirmed as of 5 November, while warning that suspicious calls, emails and SMS posing as the company or financial institutions may occur.
Sources
- SMBCコンシューマーファイナンス、保証業務のシステムに不正アクセス、最大約32万人の個人情報が漏えい (SMBC Consumer Finance: guarantee system accessed, up to about 320,000 people's data leaked), Impress Watch, 2026-11-06
- 当社保証システムへの不正アクセスによるお客さま情報の漏えいについて (Customer information leak from unauthorized access to our guarantee system), SMBC Consumer Finance, 2026-11-05
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.