Skip to content
Breach Index · running record

Mizuho data breach history (2016-2026): the 2026 contractor data loss, Eurekahedge and what else is on record

Mizuho Financial Group is one of Japan’s three megabanks. This page lists every cybersecurity or data-protection incident we could source for Mizuho from November 2016 to November 2026, newest first, with what Mizuho itself said and what is only a claim.

Short answer

Was Mizuho hacked?

We found no confirmed hack of Mizuho Bank’s own core systems from 2016 to 2026 in the sources we read. The largest incident is a data loss, not a hack: on 26 February 2026 Mizuho Bank said a storage medium from a dedicated device was lost at an outside contractor that builds systems for its overseas branches. Mizuho said the medium may have held data on up to 5,483 individual customers, 43,054 corporate clients and 9,601 employees at 18 locations in 11 countries and regions. It said it had not determined whether any data was actually on it, and found no evidence of misuse.

In August 2019 Mizuho disclosed that Eurekahedge, a Singapore hedge-fund data subsidiary it then owned 95% of, had its website system breached; Mizuho said the system was separate from its own. Mizuho’s online banking was also disrupted on 31 December 2024 during a wave of denial-of-service attacks on Japanese companies, and a ransomware group listed a “Mizuha Financial Group” on its leak site in August 2025, which Mizuho has not confirmed.

Timeline at a glance

  1. 26 Feb 2026Storage medium lost at an outside contractor; up to 5,483 individuals, 43,054 companies, 9,601 staff possibly affected. (Mizuho Bank)Confirmed
  2. 7 Aug 2025d4rk4rmy lists “MIZUHA FINANCIAL GROUP” on its leak site; Mizuho has not confirmed. (Breach House tracker)Unverified claim
  3. 12 Jun 2025Staff email sent a file with 5,572 iDeCo applicants’ details to a partner bank (via search). (Mizuho Bank (via search))Reported
  4. 31 Dec 2024Online banking disrupted for about three hours in a denial-of-service attack. (Bank Info Security)Reported
  5. 15 Aug 2019Subsidiary Eurekahedge’s website system breached; Mizuho says its own systems were not affected. (Mizuho Bank)Confirmed

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Mizuho incident timeline, in detail

Confirmed = acknowledged by Mizuho, a regulator filing or a court. Reported = credible reporting Mizuho has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Feb 2026ConfirmedThird-party / data loss

Storage medium lost at a contractor building systems for Mizuho’s overseas branches

What happened. Mizuho Bank said on 26 February 2026 that a storage medium from a dedicated device was lost at “a single specific subcontractor” entrusted with system development for its operations outside Japan. The device could connect to a development environment where some customer data from overseas locations could be used in testing. Mizuho said it was still investigating “the possibility of unauthorized removal” and could not determine whether any data was on the medium.

Impact. Maximum estimate, per Mizuho: 5,483 individual customers, 43,054 corporate clients and 9,601 employees (including some former staff) at 18 locations in 11 countries and regions, including Hong Kong, Seoul, Singapore, Bangkok, Sydney, Mumbai and Hanoi, plus subsidiaries in China, Mexico and Australia. Possible data: names, addresses, phone numbers, account numbers, balances and remittance details. Login IDs and passwords were not included. Mizuho said it found no evidence of misuse.

Sources: Mizuho Bank release (PDF), 26 Feb 2026 · Mizuho Bank news page

Aug 2025Unverified claimLeak-site claim

Ransomware group d4rk4rmy lists “MIZUHA FINANCIAL GROUP”

What happened. The Breach House tracker records a d4rk4rmy leak-site post dated 7 August 2025 naming “MIZUHA FINANCIAL GROUP”, with leak status “pending”. The tracker profiles the victim as a Japanese firm with 51–100 employees, which does not match Mizuho Financial Group, so the listing may refer to a different company or be a mislabel.

Impact. No data was published at the time of the tracker entry. Mizuho has not confirmed any incident matching the claim.

Sources: Breach House tracker entry

Jun 2025ReportedHuman error

Misdirected email with 5,572 iDeCo applicants’ data (via search)

What happened. According to search results quoting a Mizuho Bank release of 14 June 2025, an employee sent a file with details of 5,572 applicants to iDeCo (Japan’s individual pension plan), from Mizuho and other partner institutions, by email to one partner financial institution on 12 June 2025. We could not open the release itself.

Impact. An internal handling error, not an intrusion. We did not verify the data fields or the follow-up.

Sources: Mizuho Bank release, 14 Jun 2025 (Japanese, via search)

Dec 2024ReportedDenial of service

Online banking disrupted in Japan’s year-end DDoS wave

What happened. Bank Info Security, citing The Japan Times, reported that Mizuho Bank “suffered a similar denial-of-service attack that disrupted online banking services for three hours” on 31 December 2024, in a wave that also hit MUFG Bank, Resona Bank and Japan Airlines.

Impact. Service disruption only in the reporting we read. No data theft was reported.

Sources: Bank Info Security, 3 Jan 2025

Aug 2019ConfirmedSubsidiary breach

Subsidiary Eurekahedge’s website system breached

What happened. Mizuho Bank said on 15 August 2019 that Eurekahedge Pte. Ltd., a Singapore hedge-fund research provider in which it held 95%, “has announced that its website system suffered a data breach.” Mizuho said the system was separate from its own, with “no impact on other Mizuho group companies.”

Impact. Mizuho said Eurekahedge serves mainly institutional investors and does not hold bank account numbers, PIN codes, passwords or credit information. Search results cite a maximum of 120,000 accounts theoretically reachable; we could not open the detailed release to confirm it.

Sources: Mizuho Bank notice, 15 Aug 2019

Where the reports disagree

  • Is the d4rk4rmy listing Mizuho? The leak-site entry spells the name “MIZUHA” and the tracker sizes the victim at 51–100 staff. Treat it as unconfirmed and possibly not Mizuho.
  • Was data on the lost 2026 medium at all? Mizuho gives maximum numbers but says it could not determine whether any data was stored on it. Some Japanese summaries describe the contractor as a sub-subcontractor; Mizuho’s English release says only “a single specific subcontractor”.

The pattern across the record

The exposures came through contractors and subsidiaries

The two confirmed data incidents sat outside Mizuho Bank’s core: a development contractor’s device in 2026 and a separately run subsidiary website in 2019. Test environments holding real customer data were the weak point in 2026.

Availability attacks, not intrusions, hit the core bank

The direct attack on Mizuho’s services in the record is the December 2024 denial-of-service wave, which disrupted online banking for hours without any reported data loss.

What it means for Mizuho clients — and what to do

If you bank with Mizuho outside Japan, the 2026 loss is the item to know about. Mizuho says passwords were not involved, so the realistic risk is targeted fraud using names, account numbers and transaction details.

  1. 1.Check whether your branch is on Mizuho’s list

    The 2026 release names 15 branches (Hong Kong, Seoul, Singapore, Bangkok, Sydney, Manila, Mumbai, New Delhi, Bangalore, Chennai, Ahmedabad, GIFT City, Hanoi, Ho Chi Minh City, Yangon) and subsidiaries in China, Mexico and Australia. Ask your relationship manager whether your records were in scope.

  2. 2.Verify payment-change requests by phone

    Account numbers and remittance history are what invoice-redirection fraud needs. Confirm any change of beneficiary bank details on a number you already hold.

    Vendor breach lab
  3. 3.Treat unexpected “Mizuho” contacts with caution

    Do not give credentials or one-time codes to callers or email senders. Contact Mizuho through your usual branch contact.

    Phishing-resistant MFA planner

CISO takeaways

Keep real customer data out of test environments

The 2026 loss happened on a contractor device connected to a development environment that held production data. Mask or tokenize data before it reaches developers.

Vendor Breach Lab
Score your development contractors

Device control, sub-contracting chains and data-handling rules belong in the contract and the audit.

Vendor Risk Scorecard
Plan for DDoS on customer channels

Japan’s year-end 2024 wave showed that holiday periods are chosen on purpose.

DDoS readiness scorecard

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.Loss of Data Storage Medium at External Service Provider (PDF) — Mizuho Bank, 26 Feb 2026
  2. 2.Mizuho Bank news: Loss of Data Storage Medium at External Service Provider — Mizuho Group, 26 Feb 2026
  3. 3.d4rk4rmy listing: MIZUHA FINANCIAL GROUP — Breach House, 7 Aug 2025
  4. 4.iDeCo applicant information misdirected email (Japanese, via search) — Mizuho Bank, 14 Jun 2025
  5. 5.Japanese businesses hit by surge in DDoS attacks — Bank Info Security, 3 Jan 2025
  6. 6.Unauthorized access to Eurekahedge’s website system — Mizuho Bank, 15 Aug 2019

Frequently asked questions

Was Mizuho hacked?

We found no confirmed hack of Mizuho Bank’s core systems from 2016 to 2026. Its subsidiary Eurekahedge had a website breach in 2019, online banking was disrupted by a denial-of-service attack in December 2024, and in 2026 a contractor lost a storage medium that may have held overseas customer data.

What happened in the Mizuho data loss in 2026?

On 26 February 2026 Mizuho Bank said a storage medium was lost at a contractor building systems for its overseas operations. At most it could involve 5,483 individuals, 43,054 corporate clients and 9,601 employees at 18 overseas locations. Mizuho said it could not tell whether data was on it and found no misuse.

Were Mizuho passwords or online banking logins exposed?

No, per Mizuho. The 2026 release says login IDs and passwords for its services were not among the data that may have been on the medium.

Did ransomware hit Mizuho in 2025?

Not that Mizuho has confirmed. A tracker recorded a d4rk4rmy leak-site post naming “MIZUHA FINANCIAL GROUP” in August 2025, but the name and company size do not match Mizuho, and no data was published at the time.

Was Mizuho affected by the SitusAMC or Fried Frank breaches?

We found no reporting naming Mizuho among the banks affected by the 2025 SitusAMC or Fried Frank incidents, the 2023 Infosys McCamish breach or the 2025 Chain IQ attack.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Invesco data breachFinancial services

No confirmed breach; 2024 vendor ransomware in Japan

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Mizuho. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.