SMBC Consumer Finance said on 5 November 2026 that unauthorised access to the system it uses to guarantee card loans sent customer data out of that system. The catalog entry records a maximum of 320,118 people. The company detected the access on 2 November and blocked the system the same day. Fields include names, sex, dates of birth, addresses, home and mobile numbers, emails, driver-licence numbers, employer phone and income, and contract data such as bank code, customer number, guarantee amount and start date. Images of identity documents were not included. No secondary harm had been found as of the notice.
The firm is a Sumitomo Mitsui Financial Group unit, formerly Promise. It guarantees card loans for regional banks, shinkin banks and internet banks. At the end of March 2026 it had 189 partner lenders. Some of those partners provide a web application form that sits on this guarantee stack. Nikkei reported that the company's own Promise-branded consumer-finance service does not use this system and is not part of the leak. Partner banks paused some new applications while the guarantee system is stopped for checks.
What happened in the SMBC Consumer Finance data leak?
This is a guarantee-platform breach, not a run-of-the-mill leak of a single bank's core deposit system. When you take a card loan from a partner bank, SMBC Consumer Finance may stand behind that loan. The application form and the contract record live on SMBC CF's side. An unauthorised party reached that side and data left the system. The company has not published the intrusion path. It said specialists and counterparties are investigating cause and scope.
Detection on 2 November and a public notice on 5 November is fast by the standards of US healthcare filings. The Amplifon USA notice in the same week describes an eight-month gap between access and discovery. Speed of notice does not reduce 320,118 records. It does mean partner-bank customers heard about licence numbers and income while the system was still dark.
Income, employer phone and guarantee amount together are a gift for loan-phishing. A caller can quote a real bank code and a real guarantee ceiling and ask you to "re-verify" a card loan. That script will look more like a bank than a random SMS. The Who Gives A Crap vendor notice leaked spend totals for a similar reason: one extra commercial number makes a spoof easier. Different countries, same mechanic.
What data was leaked?
The official PDF lists: name, sex, date of birth, address, home telephone, mobile, email, driver-licence number, workplace information including phone and annual income, and contract information including financial-institution code, customer number, guarantee amount and guarantee start date. It states that images of driver licences and other ID documents are not in the take. The 320,118 figure is a maximum. It may fall as matching continues.
There are no card PANs or Promise-app passwords in the list. There is a driver-licence number, which Japan uses as a stable identifier. Combined with address and income it supports identity fraud and targeted lending scams. Watch for anyone offering to "remove you from the 320,000." That service is a second scam.
Who is affected?
People whose card loans were guaranteed by SMBC Consumer Finance through partner banks, including applicants who used a partner web form. Promise-branded customers are outside this system according to Nikkei. If you received an email or SMS from your bank or from SMBC CF about this notice, you are in the matched set. The company said it will write once the scope is fixed, in consultation with each partner. Unmatched people should not treat silence this week as a clearance.
What should I do after the SMBC notice?
- Wait for the official email or SMS from your lender or from SMBC Consumer Finance. Do not type licence numbers into a form that arrived first from a free mailbox.
- Log in to the partner bank only by typing the bank's website or using its app.
- If a new card-loan web form is paused, that is the guarantee system, not necessarily your deposit account. Still watch the loan account for limit changes you did not request.
- Japan does not have a US-style credit freeze. Be strict about unexpected tax, licence-renewal and bank SMS. Report misuse to the police and to the dedicated desk named in the notice.
- Keep the PDF or the letter. 320,118 is a ceiling. A later cut of the number still leaves you in scope if you were notified.
The Shiseido skin-tool notice is a smaller Japanese census with a similar "we will write when we can match you" pattern. The matching delay is when phishing is loudest.
Frequently asked questions
Is Promise (the consumer-finance brand) in this leak?
Nikkei reported that Promise-branded lending does not use this guarantee system. The official PDF describes guarantee partners, not the Promise app.
Were ID scans leaked?
No. The company said images of driver licences and other identity documents were not included. The licence number itself was.
Is 320,118 the final count?
It is the published maximum. The company said the matched set will be notified once scope is fixed with partners.
Why did some banks stop new card-loan applications?
The guarantee system is paused for safety checks. Partner notices described paused web applications and, in some cases, new loans or limit increases.
Was this ransomware?
The company described unauthorised access and outbound data. It did not name a ransomware group.
Sourcing note: counts, fields and the 2 November detection date come from SMBC Consumer Finance's 5 November PDF. The Promise-brand exclusion is from Nikkei, not from a sentence in that PDF.