Saxo Japan Ordered to Bolster Controls After Data Breach

The breach included clients’ names, contact details, date of birth, bank account information, and identity verification documents of 750 clients.

The Kanto Finance Bureau of Japan’s Ministry of Finance has issued a business improvement order against Saxo Bank Securities in response to a customer data breach earlier this year.

Saxo first discovered it was the subject of a data breach in July after hackers access a CRM system outsourced from a third-party vendor. The breach included clients’ names, contact details, date of birth, bank account information, and identity verification documents (driver’s licence, passport, ID card) of 750 clients.

Saxo suspended access to the external CRM system and permanently migrated to a system managed by its parent, Saxo Bank Group. It also enabled 2FA in all accounts and advised clients to change their passwords.

“Sufficient recurrence prevention measures have not been taken for system risk management and outsourcing management,” the Kanto Finance Bureau said in a notice.

The business improvement order requires Saxo Bank Securities to conduct a thorough analysis to identify the root causes of the breach, reinforce controls and outsourcing risk management procedures to prevent a recurrence.

Saxo has until 19 October to report on its implementation status.