A cyberattack on a third-party email service exposed 227,216 email addresses used by Sumitomo Mitsui Banking Corporation (SMBC).
The bank uses the service, operated by Arara Inc., mainly to send emails to corporate customers and some sole proprietors.
The leaked email addresses belonged to recipients of SMBC emails sent between 1 July and 31 October 2026.
The exposed information did not include account numbers, deposit balances, PINs or online banking login credentials.
SMBC first learned of the unauthorised access on 28 October, but an initial investigation found no evidence of a leak.
Arara confirmed the exposure of email addresses on 2 November.
The bank is working with Arara to establish how the breach occurred and assess its full impact.
It also plans to report the incident to the relevant authorities.
SMBC warned customers about suspicious messages impersonating the bank or other organisations.
It advised them not to click on suspicious links or share sensitive banking information.
Customers in Japan can contact a dedicated helpline, while those overseas can seek assistance from their relationship managers or customer service teams.
Featured image: Edited by Fintech News Singapore, based on image by designer vibe via Magnific
