Skip to content
Breach Index · running record

MUFG data breach history (2016-2026): Taiwan, Union Bank, the seconded-staff leak and the FSA orders

Mitsubishi UFJ Financial Group (MUFG) is Japan’s largest banking group. This page lists the cybersecurity and data-protection incidents we could source for MUFG and its units from November 2016 to November 2026, newest first.

Short answer

Was MUFG hacked?

Yes, once in a confirmed case. MUFG Bank said on 25 October 2019 that an outsider exploited vulnerabilities in the encryption device of the login system for its Local Cash Management Service and viewed screens of corporate customers of its Taiwan offices: 1,305 pieces of information on 13 corporate customers and their counterparties were exposed. In November 2018 MUFG Union Bank, then MUFG’s US bank, told customers that stolen credentials “likely… obtained from third-party sources” were used to log in to their online accounts.

The rest of the record is about data handling. In February 2025 MUFG Bank said an employee seconded from Tokio Marine & Nichido Anshin Life had passed mortgage customers’ ID numbers for 37,843 people to Tokio Marine & Nichido between April 2020 and March 2024. In June 2024 Japan’s FSA issued business improvement orders to MUFG Bank and two securities units for sharing non-public client information against clients’ wishes. MUFG’s brokerage units were also hit by Japan’s 2025 wave of phishing-driven account takeovers.

Timeline at a glance

  1. 17 Jul 2025Mitsubishi UFJ Morgan Stanley Securities confirms unauthorized access and trades from phishing. (ScanNetSecurity)Confirmed
  2. 29 Apr 2025MUFG among eight Japanese brokers with unauthorized trades in hijacked accounts. (Bloomberg)Reported
  3. 21 Feb 2025Seconded insurer employee leaked data on 37,843 MUFG Bank mortgage customers (2020-2024). (MUFG Bank)Confirmed
  4. 26 Dec 2024Online banking portals hit by network issues in Japan’s DDoS wave. (Bank Info Security)Reported
  5. 24 Jun 2024FSA business improvement orders for sharing non-public client information. (FSA Japan)Confirmed
  6. 25 Oct 2019Intrusion via a vulnerable encryption device exposes Taiwan corporate client data. (MUFG Bank)Confirmed
  7. 7 Dec 2018MUFG Union Bank notifies customers of logins with stolen credentials. (California AG)Confirmed

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

MUFG incident timeline, in detail

Confirmed = acknowledged by MUFG, a regulator filing or a court. Reported = credible reporting MUFG has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Feb – Jul 2025ConfirmedAccount takeover wave

Phishing-driven account takeovers at MUFG’s brokerages

What happened. Bloomberg reported on 29 April 2025 that eight major Japanese brokers, including MUFG, had unauthorized trading in customer accounts taken over with credentials stolen through fake broker websites; MUFG said it would listen to the circumstances of each case. On 17 July 2025 Mitsubishi UFJ Morgan Stanley Securities warned of phishing emails in its name and said it had confirmed unauthorized access and unauthorized trades believed to stem from them.

Impact. Neither MUFG unit published a case count in the sources we read. Mitsubishi UFJ Morgan Stanley Securities made one-time passwords mandatory for login from 26 May 2025 and for withdrawals from 9 June 2025. Industry-wide, Bloomberg cited about ¥100 billion of unauthorized trading since February 2025.

Sources: Bloomberg via Claims Journal, 29 Apr 2025 · ScanNetSecurity, 30 Jul 2025 (Japanese)

Apr 2020 – Mar 2024 (disclosed Feb 2025)ConfirmedInsider / seconded staff

Seconded insurance employee passes mortgage customer data to Tokio Marine

What happened. MUFG Bank said on 21 February 2025 that an employee seconded from Tokio Marine & Nichido Anshin Life had provided personal information on MUFG Bank mortgage customers to Tokio Marine & Nichido, which reported it. The data was used to calculate Tokio Marine’s fire-insurance take-up among MUFG mortgage holders. MUFG said corporate client information was also leaked by staff seconded from both insurers.

Impact. Per MUFG: 37,843 individual mortgage customers, April 2020 to March 2024; the data was branch and customer ID numbers, not names, addresses, phone or card numbers. MUFG said a third-party investigation found the data went only to Tokio Marine & Nichido and no secondary harm was found.

Sources: MUFG Bank apology, 21 Feb 2025 (Japanese PDF)

Dec 2024ReportedDenial of service

Online banking disrupted in Japan’s year-end DDoS wave

What happened. Bank Info Security reported that MUFG Bank “suffered network issues during the afternoon of Dec. 26,” affecting its Mitsubishi UFJ Direct, BizSTATION and COMSUITE portals, during a wave of denial-of-service attacks that also hit Mizuho, Resona and Japan Airlines.

Impact. Service disruption only in the reporting we read; no data theft was reported.

Sources: Bank Info Security, 3 Jan 2025

Jun 2024ConfirmedRegulatory action (Japan FSA)

FSA orders MUFG Bank and two brokerages to fix client-information controls

What happened. On 24 June 2024 the FSA issued business improvement orders to Mitsubishi UFJ Morgan Stanley Securities, Morgan Stanley MUFG Securities and MUFG Bank, and requested reports from MUFG Bank and MUFG. It found the firms repeatedly shared non-public client information within the group “knowing that their clients asked not to share their information,” and that a MUMSS board member received confidential client information from an MUFG Bank executive officer.

Impact. No fine was reported. FStech reported that the securities watchdog found at least 26 instances of inappropriate client information exchange. Improvement plans were due by 24 July 2024. This was a breach of Japan’s bank-securities firewall rules, not a hack.

Sources: FSA administrative actions, 24 Jun 2024 · FStech, 25 Jun 2024

2022ReportedBreach notice

MUFG Investor Services (US) breach notice in Maine (via search)

What happened. Search results show a Maine AG breach entry for MUFG Investor Services (US), LLC, with a discovery date of 27 May 2022 and 1,459 people affected, involving names, Social Security numbers and financial account numbers. The Maine site refused our fetcher, so we could not read the entry or confirm whether the cause was MUFG’s systems or a vendor’s.

Impact. Unconfirmed details; treat the figures as unverified until the filing is read.

Sources: Maine AG entry (via search)

Oct 2019ConfirmedExternal intrusion

Intrusion through a vulnerable encryption device exposes Taiwan corporate client data

What happened. MUFG Bank said on 25 October 2019 that it became aware on 4 October 2019 of unauthorized access to the encryption device of the authentication system for its Local Cash Management Service (the device is physically in Tokyo). The attacker exploited vulnerabilities in the device and viewed screens of some Taiwan-office customers using the service.

Impact. Per MUFG: 1,305 pieces of information on accounts, deposits and transactions of 13 corporate customers, plus data on their clients and employees, including names, bank and branch names, account numbers, amounts and email addresses. No unauthorized remittances. MUFG upgraded the device software and strengthened monitoring.

Sources: MUFG Bank release, 25 Oct 2019

Nov 2018ConfirmedCredential stuffing / account takeover

MUFG Union Bank customer accounts accessed with stolen credentials

What happened. In a notice dated 7 December 2018 filed with the California AG, MUFG Union Bank said an unauthorized third party may have used customers’ login credentials to access Union Bank Online and Mobile Banking accounts in November 2018. It said there was “no indication that the compromised credentials were obtained through our systems.”

Impact. Names, partial or full account numbers, balances and transactions may have been viewed, and some unauthorized transactions were made. The bank reset passwords and reported to law enforcement. The notice gives no count.

Sources: MUFG Union Bank notice (California AG)

Where the reports disagree

  • How many breaches of client confidentiality did the FSA find? The FSA’s English release describes repeated sharing without giving a count; FStech and other outlets cite “at least 26 instances” from the securities watchdog’s inspection.
  • MUFG Investor Services (US): only search snippets give the 1,459 figure and the date; we could not read the Maine entry.

The pattern across the record

Customer-side credentials are the recurring entry point

Union Bank in 2018 and the 2025 brokerage takeovers both used credentials stolen elsewhere. MUFG’s response in 2025 was to make one-time passwords mandatory, seven years after the Union Bank notice.

Inside the group, data moved where clients said it should not

The 2024 FSA orders and the 2025 seconded-staff leak are the same failure: client information crossing a boundary (bank to brokerage, bank to insurer) through people with legitimate access.

What it means for MUFG clients — and what to do

For MUFG customers the practical risks are account takeover through phishing and misuse of data shared inside or around the group. Neither needs a hack of MUFG’s core systems.

  1. 1.Turn on one-time passwords and bookmark the real login page

    The 2025 takeovers began on fake broker sites. Type the address or use a bookmark, and use the strongest login option offered.

    Phishing-resistant MFA planner
  2. 2.Never reuse your banking password

    Union Bank’s 2018 notice says the stolen credentials likely came from other sites. A unique password stops that path.

    Leaked credential response
  3. 3.Check MUFG letters if you hold a mortgage with MUFG Bank

    MUFG said it would contact the 37,843 affected mortgage customers individually and will not call to ask for personal information about this case.

CISO takeaways

Rehearse an account-takeover wave

Detection, customer contact and reimbursement policy when stolen credentials hit thousands of accounts.

Account Takeover Lab
Control seconded and partner staff access

Seconded staff carry their home company’s incentives. Scope their access and log exports.

Insider Data Theft Lab
Defend logins against reused passwords

Union Bank’s 2018 takeovers used credentials stolen elsewhere. Rate limits, breached-password checks and step-up authentication stop most of it.

Credential Stuffing Lab

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.Data Breach Involving Customer and Third-Party Information at Taiwan Offices — MUFG Bank, 25 Oct 2019
  2. 2.MUFG Union Bank Notice of Data Breach — California Attorney General, 7 Dec 2018
  3. 3.Administrative actions against MUMSS, MSMS and MUFG Bank — Financial Services Agency (Japan), 24 Jun 2024
  4. 4.Japan’s FSA penalises MUFG for client data breaches — FStech, 25 Jun 2024
  5. 5.Apology for leak of customer information by seconded staff (Japanese) — MUFG Bank, 21 Feb 2025
  6. 6.Japanese businesses hit by surge in DDoS attacks — Bank Info Security, 3 Jan 2025
  7. 7.Hackers manipulate markets in $700 million illicit trading spree — Bloomberg (via Claims Journal), 29 Apr 2025
  8. 8.One-time passwords made mandatory; warning on phishing in MUMSS’s name (Japanese) — ScanNetSecurity, 30 Jul 2025
  9. 9.MUFG Investor Services (US) breach entry (via search) — Maine Attorney General, 2022

Frequently asked questions

Was MUFG hacked?

Yes, in 2019: MUFG Bank confirmed an intruder exploited flaws in the encryption device of a cash-management login system and viewed data on 13 corporate customers of its Taiwan offices. Its former US unit MUFG Union Bank also reported logins with stolen credentials in 2018.

What was the MUFG data leak in 2025?

In February 2025 MUFG Bank said an employee seconded from Tokio Marine & Nichido Anshin Life passed branch and customer ID numbers of 37,843 mortgage customers to Tokio Marine & Nichido between April 2020 and March 2024. Names and addresses were not included, per MUFG.

Why did Japan’s FSA penalise MUFG in 2024?

The FSA issued business improvement orders on 24 June 2024 because MUFG Bank and two securities units shared non-public client information within the group although clients had asked them not to. No fine was reported.

Were MUFG securities accounts hacked in 2025?

Customer accounts were taken over using credentials stolen by phishing, not by breaking into MUFG systems. Mitsubishi UFJ Morgan Stanley Securities confirmed unauthorized access and trades and made one-time passwords mandatory in May and June 2025.

Was MUFG affected by SitusAMC or Fried Frank?

We found no reporting naming MUFG among the banks affected by the 2025 SitusAMC or Fried Frank incidents, the 2023 Infosys McCamish breach or the 2025 Chain IQ attack.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Invesco data breachFinancial services

No confirmed breach; 2024 vendor ransomware in Japan

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by MUFG. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.