Iwai Cosmo Securities had made MFA mandatory after Japan's 2025 account-takeover wave. On Oct 14, attackers placed orders in 7 customer accounts anyway (5 executed), without logging in as them: through a misconfigured admin function at Trade Works, the vendor that runs its trading platform.
Customer authentication protects the front door. Admin and back-office functions can trade on every account.
https://japancyberwatch.com/articles/iwai-cosmo-securities-unauthorized-trades-vendor-admin-2026