A viral post says a Japanese broker might compensate only half of a customer's losses after hackers trade in their account. Imagine opening your portfolio and discovering that someone else has been playing day trader with your savings. The market is volatile enough without an uninvited guest at the keyboard.
The answer, as of October 26, 2026: Rakuten Securities published a baseline of 50% of defined eligible losses for a 2025 incident, plus eligible fees and a ¥10,000 goodwill payment. SBI Securities had a similar historical policy, but assesses incidents occurring from October 26, 2025 individually. Tachibana Securities reported restoring certain victims' losses in full in July 2025; that is not a lifetime promise for every account.
What each policy actually says
| Broker | Published response | Important limitation |
|---|---|---|
| Rakuten Securities | Baseline 50% of eligible losses, trading-fee refund, ¥10,000 for qualifying victims | An unauthorized sale of shares you already owned is not itself part of its 50% loss calculation |
| SBI Securities | For its earlier policy, 50% baseline, certain costs refunded in full, ¥10,000 payment | Incidents from October 26, 2025 are evaluated case by case, including security settings |
| Tachibana Securities | Said it had restored affected accounts in full on July 30, 2025 | Incidents from July 26, 2025 onward may receive limited or no compensation; a police report is required under its announcement |
These are not three comparable promises for the same future event.
Rakuten's 50% has a very specific denominator
Rakuten's notice was issued on July 25, 2025 and updated February 18, 2026. Its defined loss includes realized losses from securities bought by the intruder, plus valuation losses on those unauthorized purchases still held. Selling securities the customer owned before the intrusion is excluded from that defined loss calculation, although victims of sales alone can qualify for the goodwill payment.
If an eligible unauthorized purchase creates an assessed ¥1 million loss, a 50% baseline means ¥500,000, potentially plus ¥10,000 and applicable fee refunds. It does not mean an intruder selling ¥1 million of existing holdings automatically triggers a ¥500,000 payout. Sale proceeds, transaction volume, actual loss and compensable loss are four different things. Financial footnotes have entered their final-boss phase.
SBI changed its approach by incident date
SBI's July 2025 terms covered qualifying unauthorized purchases and related sales with a 50% baseline. Certain transaction costs were reimbursed 100%; a ¥10,000 payment also applied. For accounts where the intruder only sold previously held securities, the published remedy was limited to eligible expenses and the payment.
But for incidents on or after October 26, 2025, SBI says whether and how much it compensates depends on individual review of credential management and use of security features, among other facts. Saying every current SBI claim is settled at 50% is inaccurate. So is promising that enabling a passkey automatically guarantees full reimbursement.
Tachibana's full repayment: which service?
Tachibana announced on August 7, 2025 that it had completed full restoration for the affected customers on July 30. The same notice says incidents from July 26, when additional login verification became mandatory, would be reviewed individually, potentially without compensation; reporting the incident to police is a condition.
Crucially, Tachibana has separate online services, Stock House and e-shiten. Its e-shiten notice dated May 19, 2025 said attacks had been confirmed at Stock House but not at e-shiten at that time. One service's historic full repayment cannot be treated as a blanket guarantee for the other. E-shiten plans to require passkey login for trading and withdrawals from December 12, 2026.
Did attacks continue into 2026?
Yes. Japan's Financial Services Agency reported 5,490 unauthorized accesses and 3,033 unauthorized trades for April 2025, compared with 43 and 25 in August 2026, and 37 and 2 in September 2026. These provisional figures, updated October 9, 2026, show the threat has declined, not disappeared. Two firms reported unauthorized trades in September, but the published table does not name them.
A social-media post circulating in October 2026 does not establish that a new mass breach happened at Rakuten that month. The Rakuten compensation notice itself dates to July 2025. The date of a post is not the date of an incident.
What account holders should do
Use a saved official bookmark rather than an email link. Preserve account alerts, transaction history and timestamps. Contact the broker immediately, secure login and trading credentials, and follow its account-protection instructions. Report the case to police where required. Enable passkeys, transaction protections and alerts where available; update devices and review account activity. Beware of fake compensation forms: a fraud refund is a particularly cruel excuse for a second fraud.
Bottom line: Ask which incident date, which loss definition and which eligibility conditions before comparing reimbursement percentages. Security settings matter more than a reassuring number on an old announcement.
References (7)
- Rakuten Securities, compensation policy, 2025-07-25 (updated 2026-02-18)
- SBI Securities, compensation policies, 2025-07-25 / 2025-10-26
- Tachibana Securities Stock House, compensation, 2025-08-07
- Tachibana Securities e-shiten, security alert, 2025-05-19
- Tachibana Securities e-shiten, passkey requirement, 2026-07-08
- Japan Financial Services Agency, provisional fraud figures, updated 2026-10-09
- Japan Financial Services Agency, account-security guidance, updated 2026-10-09
