SBI Securities stated on October 8 that it has found no evidence of damage to accounts held at its own brokerage, in connection with a suspected case in which hijacked Google or Apple accounts were used to abuse passkeys and carry out unauthorized trades. According to ITmedia, the company described the matter as one reported by another securities firm, not by SBI Securities itself.
The clarification followed the spread of posts on X that could be read as saying harm had occurred in SBI Securities accounts. The company pointed to a warning it had published on October 2 and said the confusion prompted it to make clear that its own customers were not the subject of that alert.
Why it matters
Passkeys are marketed as a stronger replacement for passwords because the private key never leaves the user's device, which makes them resistant to ordinary phishing pages that capture typed credentials. The suspected case described in the October 2 warning suggests a different path: if an attacker gains control of the Google or Apple account that stores and syncs the passkey, the protection can be undermined without any flaw in the passkey standard itself.
For retail investors in Japan, the episode also shows how quickly a general industry warning can be misread as a firm-specific breach. SBI Securities is one of the country's largest online brokerages, so a claim that its accounts were compromised travels fast, and the company spent part of its response correcting that impression rather than describing an incident of its own.
What the October 2 warning actually said
In the notice issued on October 2, SBI Securities wrote that a suspected case had been identified in which phishing and similar methods let a third party improperly obtain account information for services such as Google and Apple, and then misuse passkeys or password notes stored in the cloud to log in to securities accounts and place unauthorized trades.
That notice was issued on the basis of a communication sent by the Japan Securities Dealers Association to its members, and it concerned a case reported by some member firms. The original wording did not state that the matter involved another company, according to ITmedia, which is how posts interpreting it as an SBI Securities incident came to circulate.
The company's October 8 statement drew that line explicitly: the case belongs to other brokerages, and no damage has been confirmed in accounts at SBI Securities at this point.
The advice the firm is giving customers
Alongside the correction, SBI Securities repeated the precautions it had set out earlier. It urged users to adopt passkeys and to disable their login passwords, on the logic that removing a password removes one of the things an attacker can steal or guess.
It also asked customers to check that two-step verification is switched on for the Google and Apple accounts where their credentials are stored, since those accounts act as the vault for synced passkeys and saved password notes. And it advised users not to trust unsolicited guidance or links about account settings, a common route for phishing attempts.
The combination reflects the mechanics of the suspected case. If a passkey is synced through a cloud account, then the security of that account becomes part of the security of the brokerage login, and a password memo saved in the same place can hand an attacker a second way in.
What to watch
The underlying case remains attributed to other securities firms, and SBI Securities has not said whether it expects further updates. Customers who followed the October 2 guidance and want to verify their own settings can review passkey registration, password status and two-step verification on their Google or Apple accounts, and treat any message directing them to change those settings as suspect until confirmed through official channels.
