SMBC Consumer Finance, a major consumer lender under Sumitomo Mitsui Financial Group, said on the 5th that unauthorized access to the system it uses to guarantee card loans exposed the data of up to 320,118 customers. Names, annual incomes and borrowed amounts were among the information that leaked, the company said.
The data belonged to customers of regional banks, shinkin credit unions and online banks whose card loans SMBC Consumer Finance guarantees. It included the borrowers' names, sex, dates of birth, addresses, phone numbers, email addresses, driver's license numbers, employers and annual incomes, along with the code of the lender that issued the loan, customer numbers, guaranteed amounts (the borrowed sums) and contract dates.
Docomo SMTB Net Bank, formerly Sumishin SBI Net Bank, said the same day that up to 122,635 of the people affected are its customers.
SMBC Consumer Finance, known until its rebrand as Promise, detected the unauthorized access on the 2nd and cut off access to the guarantee system. Some data was nevertheless sent outside the company, and it included customer information, the lender said. It said it has so far found no misuse of the leaked data.
As of March 2026 the company was providing guarantee services to 189 financial institutions.
The disclosure follows a run of similar incidents at Japanese financial and other organizations, among them NTT Docomo and the Fire and Disaster Management Agency, with the companies themselves announcing each case.