Tokyo Stock Exchange Crashed in 2005: A 4.5-Hour Software Bug

On Tuesday, November 1, 2005, operators at the Tokyo Stock Exchange switched on the trading system at 6:30 a.m., like any other business day. The system read a file, decided something was wrong and stopped. Asia's largest bourse went four and a half hours without trading stocks. There was no intruder, no ransomware, no attack: it was a bug sleeping in the code that woke up on the worst possible day.

What happened on November 1, 2005

According to contemporary coverage (Mail & Guardian), it was the first time the Tokyo Stock Exchange (TSE) had suspended trading in all shares. In the exchange's own statement, reproduced by Global Custodian, trading was suspended from 9:00 a.m. to 1:30 p.m. Trading resumed at 1:30 p.m., and the Nikkei 225 still closed up 261.36 points at 13,867.86.

The Register called it the worst interruption in the exchange's history. The market was running hot, and the failure hit just as the TSE was adding capacity to handle higher order volumes.

What caused the Tokyo Stock Exchange outage?

A defect in a program that processes brokerage data, exposed by a capacity upgrade Fujitsu delivered in October 2005. At startup, reading the files that hold data on trading participants failed; the system detected that what it read was not what it expected and shut itself down. A restart attempt hit the same problem, and the system locked up again.

The TSE's official explanation described a latent bug that already existed in a program tied to those files and only surfaced after the order-processing capacity was increased. An exchange spokesman told Reuters that flawed instructions received from Fujitsu about the software improvements seemed to have caused the glitch.

The fallout for Fujitsu

The bill came quickly. According to The Register, Fujitsu's board halved president Hiroaki Kurokawa's salary for six months and imposed 10% to 25% pay cuts on other senior executives, including those running the financial systems division. Three days later the Nagoya Stock Exchange had a similar halt, also traced to Fujitsu software.

What stands out in the TSE statement is that it published a detailed account of what failed, along with an apology. That is post-mortem practice, and much of the security and operations world still struggles to reach that level of transparency.

Availability is security too

In information security, the classic model has three pillars: confidentiality, integrity and availability. You can lose the third with no attacker involved. A stock exchange, a bank or an online store that is down costs the same money whether the cause is a criminal or a bad deploy.

The pattern repeats in cases we have covered here:

• The CrowdStrike outage in July 2024 took down millions of Windows machines because of an update, not an attack.
• SQL Slammer showed the other side: a 376-byte worm that overloaded whole networks and services in 2003.
• In the Colonial Pipeline case, operations were halted as a precaution after a ransomware attack.

What you can apply at work or in your home lab

You do not run a stock exchange, but the mechanics of the mistake are the same in any update:

1. Test the startup path, not just normal operation. The TSE defect only showed up when the system was switched on and read its files. Restart the test environment from scratch.
2. Have a way back. Before any big update, know how to roll back: a VM snapshot, a system image or the previous package version.
3. Roll out in waves. One server or a pilot group first; the rest only after a few hours without problems.
4. Avoid changes right before a peak. Month-end, payroll runs and sale days are not the time to touch things.
5. Test your restores. A backup that has never been restored is an assumption; the 3-2-1 backup rule only counts if someone has actually recovered a file.

The bigger lesson

The 2005 mistake was not only in the code. It was in the process: a fix went into production with wrong instructions, and nobody noticed until the morning the market opened. Not every incident has a villain. Many are a change with no startup test and no rollback plan. If you want to keep going down this road, read about what actually broke in the CrowdStrike outage.

Sources consulted: Mail & Guardian (Nov 1, 2005), Global Custodian — TSE statement (Nov 21, 2005), The Register (Nov 25, 2005), Computer History Museum. Note: reported duration varies between sources; I used the suspension window given by the TSE itself.