SMBC Consumer Finance breach exposes 320,118 bank loan customers

SMBC Consumer Finance, the Sumitomo Mitsui consumer lender behind the Promise brand, says attackers took personal data on up to 320,118 people from the system it uses to guarantee card loans for other banks. In its notice on Thursday, the company said a third party broke into the system and that data sent out of it included customers' personal information.

The company guarantees card loans for regional banks, shinkin banks and online banks, and supplies some of them with the web form customers use to apply. It says it detected the intrusion on Monday, November 2, cut off access to the guarantee system the same day, and found the data theft while checking for other unauthorised access. The guarantee system remains suspended.

What was taken

The stolen data covers name, sex, date of birth, address, home and mobile phone numbers, email address, driving licence number, employer details including phone number and annual income, and contract details: the bank's code, the customer number, the guaranteed amount and the date the guarantee began. Images of identity documents were not included, SMBC Consumer Finance says. It plans to contact affected people by email or SMS once it has worked out who they are, in consultation with each partner bank.

Partner banks

The banks whose customers are in the data have started publishing their own numbers. Docomo SMTB Net Bank, formerly SBI Sumishin Net Bank, says up to 122,635 of its card loan customers are affected, more than a third of the total, and that its own banking systems were not accessed.

The data also reaches back years. Resona Bank, Kansai Mirai Bank and Minato Bank said on Friday that SMBC Consumer Finance used to guarantee their loans, and that the stolen data includes 5,935 customers whose card loans or free loans have already been closed. The oldest were taken out at the former Nara Bank between 2001 and 2005; others run from 2002 to July 2026.

Earlier outage

Days before the breach was found, Promise took its website and app offline on October 30 for what it called emergency maintenance, and brought them back on November 2 after a security check, with email address changes and biometric registration still unavailable. SMBC Consumer Finance has not said whether the two events are connected.

What is not known

The company has not said how the attackers got in, how long they had access, or whether a ransomware group is involved, and no group has publicly claimed the attack. It says it has seen no fraud resulting from the leak so far, but warns customers to expect calls, emails and texts from people posing as the company or their bank.