Skip to content
Breach Index · running record

Nomura data breach history (2016-2026): Kikan Navi, vendor leaks, account takeovers and the 2020 insider leak

Nomura Holdings is Japan’s largest securities group. This page lists every cybersecurity and data-protection incident we could source for Nomura group companies from November 2016 to November 2026, newest first, with what Nomura said.

Short answer

Was Nomura hacked?

Yes, at a group company. Nomura Investor Relations, wholly owned by Nomura Holdings, said on 4 November 2026 that it confirmed unauthorized access on 2 November 2026 to “Kikan Navi”, its IR information service for institutional investors and analysts, and that information leaked; names and email addresses may be included. It suspended the service and a sister service on the same server. No count had been published.

Nomura Securities’ own incidents are vendor and customer-side ones. In October 2026 it said an email-delivery contractor, Ymirlink, was breached and email addresses of i-Port users may have leaked. In October 2025 survey answers leaked from a sub-contractor’s cloud service. In 2025 phishing let criminals trade in hijacked customer accounts, which Nomura said it would compensate case by case. In 2020 a Nomura employee leaked data on 275 corporate clients to a rival broker.

Timeline at a glance

  1. 4 Nov 2026Nomura Investor Relations: unauthorized access to Kikan Navi on 2 Nov; names and emails may have leaked. (Nomura Investor Relations)Confirmed
  2. 23 Oct 2026Email contractor Ymirlink breached; i-Port users’ email addresses may have leaked. (DX Magazine)Reported
  3. 17 Oct 2025Customer survey IDs and answers leaked from a sub-contractor’s cloud service. (Nomura Securities)Confirmed
  4. 2 May 2025Nomura confirms unauthorized trades in phished accounts; case-by-case compensation. (Nomura Securities)Confirmed
  5. 10 Sep 2020Employee leaked data on 275 corporate clients to Nippon Institutional Securities. (Bloomberg)Confirmed

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Nomura incident timeline, in detail

Confirmed = acknowledged by Nomura, a regulator filing or a court. Reported = credible reporting Nomura has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Nov 2026ConfirmedExternal intrusion (group company)

Unauthorized access and data leak at Nomura Investor Relations’ “Kikan Navi”

What happened. Nomura Investor Relations Co., Ltd. said on 4 November 2026 that it confirmed unauthorized access by a third party to its Kikan Navi system on 2 November 2026, and later that information had leaked. Kikan Navi gives institutional investors and analysts information on company results briefings and manages attendance. MIR@I, a service for individual investors on the same server, was suspended as a precaution.

Impact. The leaked information may include names and email addresses; the investigation covers past registrants too. No number had been published. Nomura IR warned of follow-on emails, calls and SMS pretending to be Nomura.

Sources: Nomura Investor Relations notice (Japanese PDF), 4 Nov 2026 · Nomura Investor Relations news page

Oct 2026ReportedThird-party / email service

Email contractor Ymirlink breached; i-Port users’ addresses may have leaked

What happened. DX Magazine reported that Nomura Securities announced on 23 October 2026 that Ymirlink, which delivers email for i-Port (Nomura’s portfolio tool for financial institutions), found unauthorized access to its systems on 16 October and confirmed on 22 October that data had been taken from a database.

Impact. Email addresses and similar data for i-Port subscribers may have leaked. Nomura said portfolio and securities-account data were not included and no misuse or access to Nomura’s systems had been found. No count was published.

Sources: DX Magazine (Japanese)

Oct 2025ConfirmedThird-party / fourth party

Customer survey answers leaked from a sub-contractor’s cloud service

What happened. Nomura Securities said on 17 October 2025 that it outsourced customer-satisfaction survey processing to Nomura Research Institute and NRI Financial Graphics, which sub-contracted it to another firm. That firm’s cloud service, used to read survey answers, was accessed without authorization and respondent IDs and answers leaked.

Impact. About 40 free-text answers contained information that could identify a person; Nomura said it would contact them. Nomura said no unauthorized access to its own systems was found.

Sources: Nomura Securities release (Japanese PDF), 17 Oct 2025

Feb – Jul 2025ConfirmedAccount takeover wave

Phishing-driven account takeovers and unauthorized trades

What happened. Nomura Securities said on 2 May 2025 that phishing emails posing as Nomura or its partners were stealing account numbers and passwords, and that it had confirmed unauthorized trades in customers’ online accounts. Bloomberg named Nomura among eight brokers affected and quoted it saying it “would respond flexibly based on the individual circumstances of affected customers.”

Impact. Nomura said it would pay a certain level of compensation case by case. It published no count we could find. Industry-wide, Bloomberg cited about ¥100 billion of unauthorized trading since February 2025.

Sources: Nomura Securities notice, 2 May 2025 (Japanese) · Bloomberg via Claims Journal, 29 Apr 2025

Jan – Jul 2020ConfirmedInsider

Employee leaks corporate client data to a rival broker

What happened. Nomura Holdings said on 10 September 2020 that an employee leaked data on corporate clients to Nippon Institutional Securities, a Nikko Asset Management unit, at the request of a former Nomura colleague who worked there. Nippon Institutional said its sales manager received the information several times between January and July 2020.

Impact. Per Nomura: data on 275 companies, mainly financial institutions, including information on ETF dealings and transactions with Nomura. Nomura apologised and said it would consider legal measures. Bloomberg noted it followed a 2019 leak of market information that drew an FSA business improvement order.

Sources: Bloomberg via BusinessDay, 10 Sep 2020

Where the reports disagree

  • How many Nomura customers lost money to the 2025 account takeovers? Nomura did not publish a count in the sources we read; industry totals from the FSA and Bloomberg cover all brokers and are not a Nomura figure.
  • Some Japanese trackers list a 2024 ransomware incident against “Nomura”; we found no Nomura statement and it is not included.

The pattern across the record

Vendors, sub-contractors and group companies hold the data

Three of the five incidents ran through someone else’s systems: an email-delivery contractor, a survey sub-contractor’s cloud service, and a group IR company. Nomura Securities said its own systems were not accessed in the vendor cases.

People with access are the other path

The 2020 leak was an employee printing client data for a former colleague, and it came a year after an FSA order over a separate information leak. The 2025 takeovers used customers’ own stolen credentials.

What it means for Nomura clients — and what to do

Nomura customers and IR-service users face two practical risks: phishing that uses leaked email addresses, and logins with stolen passwords. Neither requires Nomura’s trading systems to be breached.

  1. 1.Expect phishing that uses your real email address

    After the Kikan Navi and Ymirlink leaks, treat emails or texts “from Nomura” with care and log in only through a bookmark.

    Phishing-resistant MFA planner
  2. 2.Turn on the strongest login protection

    Use one-time passwords or passkeys where offered, and a unique password for your brokerage account.

    Leaked credential response
  3. 3.Report unauthorized trades at once

    Nomura said compensation is decided case by case. Report quickly and keep screenshots of any phishing message you received.

CISO takeaways

Map your fourth parties

The 2025 survey leak sat two contracts away from Nomura. Know who your vendors’ vendors are and what data reaches them.

Third-party breach checklist
Rehearse an account-takeover wave

Japan’s 2025 wave moved from phishing to market manipulation in weeks.

Account Takeover Lab
Watch for client data leaving with staff

Departing and recently departed staff are the classic route for client lists.

Insider Data Theft Lab

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.「機関Navi」への不正アクセスおよび情報漏えいについて (PDF) — Nomura Investor Relations, 4 Nov 2026
  2. 2.Kikan Navi incident news page — Nomura Investor Relations, 4 Nov 2026
  3. 3.Nomura Securities: possible leak via outsourced email delivery (i-Port) — DX Magazine, Oct 2026
  4. 4.委託先企業が利用するクラウドサービスへの不正アクセスによる情報流出について (PDF) — Nomura Securities, 17 Oct 2025
  5. 5.Phishing-related unauthorized access and compensation policy — Nomura Securities, 2 May 2025
  6. 6.Hackers manipulate markets in $700 million illicit trading spree — Bloomberg (via Claims Journal), 29 Apr 2025
  7. 7.Nomura reveals client data leak to securities firm Nippon — Bloomberg (via BusinessDay), 10 Sep 2020

Frequently asked questions

Was Nomura hacked?

A Nomura group company was. Nomura Investor Relations, wholly owned by Nomura Holdings, said on 4 November 2026 that its Kikan Navi investor service was accessed without authorization and information leaked. Nomura Securities’ other incidents were at vendors or involved phished customer accounts.

What leaked in the Nomura Kikan Navi breach?

Nomura Investor Relations said names and email addresses may be included and that past registrants are within scope of the investigation. It had not published a number of affected people as of its 4 November 2026 notice.

Did Nomura compensate customers for unauthorized trades in 2025?

Nomura Securities said on 2 May 2025 that it would examine the damage and pay a certain level of compensation depending on each case. It did not publish totals in the sources we read.

What was the Nomura data breach in 2025?

In October 2025 Nomura Securities said respondent IDs and answers from its customer-satisfaction survey leaked from a cloud service used by a sub-contractor; about 40 answers could identify a person. Separately, phishing let criminals trade in some customers’ accounts that spring.

Was Nomura affected by SitusAMC or Fried Frank?

We found no reporting naming Nomura among firms affected by the 2025 SitusAMC or Fried Frank incidents, the 2023 Infosys McCamish breach or the 2025 Chain IQ attack.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Invesco data breachFinancial services

No confirmed breach; 2024 vendor ransomware in Japan

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Nomura. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.