SMBC Consumer Finance breach: card-loan guarantee data on up to 320,118 people sent out, including driver's licence numbers, incomes and loan amounts

What happened

SMBC Consumer Finance, the Sumitomo Mitsui Financial Group consumer-lending company formerly known as Promise, announced on November 5, 2026 that a third party had gained unauthorised access to the system it uses for its guarantee operations for card loans and other products, and that customer data for up to 320,118 people was transmitted outside the company. The company detected the unauthorised access on November 2 and blocked access to the guarantee system the same day; the external transmission was confirmed as it investigated whether there had been other suspicious communications. The guarantee system has been suspended while safety checks and maintenance continue. The company has not disclosed the attack method or cause, and says it is working with experts to identify the full scope. One partner alone, Docomo SMTB Net Bank, said the same day that up to 122,635 of its own customers may be among those whose information leaked — the guarantee service covered 189 partner financial institutions as of March 2026, including regional banks, shinkin banks and internet banks.

Who is affected

People whose card loans and similar products were guaranteed through SMBC Consumer Finance by one of its partner financial institutions — customers of the partner banks, not only direct SMBC customers. The data transmitted covers names, gender, dates of birth, addresses, home and mobile phone numbers and email addresses; driver’s licence numbers (the company says licence images were not leaked); employer names, workplace phone numbers and annual incomes; and contract information including financial-institution codes, customer numbers, guaranteed amounts — the amounts borrowed — and guarantee start dates. The company plans, once the affected scope is identified, to notify affected customers individually by email or SMS in consultation with its guarantee partners. It says no secondary harm, such as misuse of the information, has been confirmed so far.

How serious

The concrete risk is identity fraud and highly targeted phishing built on real borrowing records. This is not a list of email addresses: it pairs full identity details — name, date of birth, address, phone number and a driver’s licence number — with the victim’s employer, annual income and the size and start date of an actual loan, held at a named bank. That combination is enough to impersonate a customer convincingly to a lender, to pass knowledge-based identity checks, and to write loan-themed scam calls, emails and texts that quote real figures the victim recognises. The company itself warns that suspicious calls, emails and SMS messages claiming to be from the company or from financial institutions may follow. Because the data left through a guarantee provider, many affected people may never have dealt with SMBC Consumer Finance directly — their own bank’s name is the one a scammer is most likely to use.

What to do now

Watch for an individual notice from your bank or from SMBC Consumer Finance, delivered by email or SMS once the company finishes identifying who is affected — but treat every such message as a claim to verify, not an instruction to follow. Do not open links or enter personal information from an unexpected message about this breach: go to your bank through its official app or a number you already trust, and use the company’s dedicated hotline or the police if a caller presses you, as the company itself advises. Be alert for calls or messages that quote your loan amount, income or licence number to sound legitimate — quoting real details is exactly what this data enables, and no bank needs you to confirm them on an inbound call. Check your bank and card statements for unfamiliar activity, and tell your bank at once if a new loan, guarantee or account change appears that you did not request.

Sources: BigGo Finance, November 5, 2026 (reporting SMBC Consumer Finance’s announcement) · TBS News Dig, November 5, 2026