SMBC Consumer Finance: data on up to 320,118 loan customers taken, including licence numbers and income

If you have a card loan from a Japanese regional bank, credit union or online bank, the company that guarantees it may have had your details taken. On November 5, 2026, SMBC Consumer Finance said a third party got into the system it uses for loan guarantee work and sent data out of it, including personal information of up to 320,118 people. Some of the banks that use its service have since posted their own notices. This is not the same incident as the Arara email leak that hit Sumitomo Mitsui Banking Corporation (SMBC) this week, though both involve companies in the same financial group.

What happened

SMBC Consumer Finance is the company formerly known as Promise, according to ITmedia NEWS (in Japanese). It backs card loans for banks, credit unions and online banks, and for some of them it also provides the web application form. Its notice (PDF, in Japanese) gives this order of events:

• November 2: it detected unauthorized access and, the same day, cut access to the system used for guarantee work.
• While checking for other intrusions: it confirmed that the data sent out included customers’ personal information.
• November 5: it announced the incident. It has paused the guarantee system while it checks it and carries out maintenance.

The company hasn’t said how the attacker got in, who it was or how long they were inside. It says it is working with outside experts to find the cause and the scope. As of its notice, it says it has not confirmed any secondary harm.

Who is affected

The system serves 189 partner financial institutions as of the end of March 2026, according to ITmedia and Nikkei (in Japanese). The count is up to 320,118 people. Nikkei reports that SMBC Consumer Finance’s own consumer lending brand, Promise, doesn’t use this system.

Partner banks have been publishing their own numbers. One example so far:

• Docomo SMTB Net Bank (in Japanese): up to 122,635 of its card-loan customers. It says its own banking systems weren’t accessed and its other services aren’t affected.

Other banks may follow. If you have a card loan, check the website of the bank that issued it.

What data was involved

According to the notice, the information that may have been taken is:

• name, gender and date of birth
• address, home phone number, mobile phone number and email address
• driver’s licence number
• workplace information, such as its phone number and annual income
• contract information: financial institution code, customer number, guaranteed amount and guarantee start date

Images of driver’s licences or other identity documents were not included. The data doesn’t include passwords or card numbers, according to the lists published so far.

What the company says to do

SMBC Consumer Finance says it will contact affected customers by email or SMS once it has pinned down who is in scope, after talking to the partner institutions. Until then, it warns that people may get suspicious calls, emails and texts pretending to be SMBC Consumer Finance or a financial institution. If one looks off, it asks people not to open links or enter personal information, and to contact its dedicated line or the police instead. The customer line is 0120-362-167 or 03-5677-9228, open 9 AM to 6 PM every day, it says (in Japanese).

What this means for you

A driver’s licence number with a salary and a loan amount is a fuller picture of someone’s finances than most leaks contain. It can make a fake call from your "bank" or a "debt collector" sound uncomfortably accurate. The licence number can’t easily be changed, but a number alone is not a licence image, so the risk is mostly impersonation and social engineering rather than someone being able to show ID.

What you can do

1. Check your bank’s notice first. If you have a card loan, look on your bank’s website for its statement and use the contact details there.
2. Treat unexpected contact about your loan as suspect, even if the caller knows your income or loan amount. Hang up and call the number on your bank’s site or your card.
3. Don’t click links in texts or emails about this. The company will contact you by email or SMS, so go to the bank’s own site or app to confirm anything.
4. Look over your loan and bank statements for anything you don’t recognize, and ask your bank about it.
5. Be wary of people offering to "fix" it for a fee. Breach notices often attract scammers. See how scammers use leaked data.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each service its own address, so a fake message that arrives at the wrong one stands out. Frame never collects or stores the leaked records themselves.

Related coverage

• Arara breach: Bic Camera, SMBC and other client notices: the separate incident at an email service that also involves Sumitomo Mitsui Banking Corporation.
• How scammers use leaked data to make phishing personal: what to expect after a leak like this.
• The IDScan.net breach: what a leak of scanned IDs means: a related case, where ID details were in the data.

Sources

• SMBC Consumer Finance, 当社保証システムへの不正アクセスによるお客さま情報の漏えいについて (PDF, in Japanese), November 5, 2026
• SMBC Consumer Finance, お客さま専用窓口へのフリーダイヤル追加のお知らせ (in Japanese), November 6, 2026
• Docomo SMTB Net Bank, SMBCコンシューマーファイナンス（保証提携先）への不正アクセスによる当社カードローンのお客さま情報の漏えいについて (in Japanese), November 5, 2026
• ITmedia NEWS, 年収やローン保証額、免許証番号など最大32万人分漏えい (in Japanese), November 6, 2026
• Nikkei, 三井住友系の消費者金融大手、カードローン契約額など32万人分漏洩 (in Japanese), November 5, 2026