SmartNews has suspended point redemptions in its news app after a third party made unauthorised changes to its points and rewards systems, the company says, in a SmartNews security incident that it is treating as separate from a breach it disclosed nine days earlier. The company has not said that any personal data was exposed and says it is still investigating whether user accounts were affected.
In an update on its newsroom, SmartNews says it confirmed on 31 October that an outsider had gained unauthorised access to some of the systems it operates. It took those systems offline and is revoking and rotating credentials. Its Japanese notice says the access took place between 31 October and 1 November, Japan time.
What the SmartNews security incident has hit so far
The company names two areas under review. In the points and rewards systems, it says it has confirmed that a third party carried out unauthorised operations. Redemptions are paused as a precaution while it checks whether any accounts were affected. It has not given a number of users or points involved.
Advertising is the second area. Ads are still being delivered, SmartNews says, but it is investigating the impact on advertising-related systems and information.
To protect the service, the company has also suspended or restricted some features. Personalised feeds, push notifications and some rewards are unavailable, and the app may be intermittently unavailable while the work goes on. A first, shorter notice on 31 October said only that a security issue had been found and some features suspended as a precaution.
The same update is posted on the SmartNews Help Center. Users who see unexpected changes to their points or rewards are asked to contact support through it.
The first intrusion, on 22 October
SmartNews first reported a potential security issue on 22 October and suspended some services. A day later it said a third party had gained access by exploiting a vulnerability in its server environment, that it had fixed the flaw and that core services were back. As of 11 p.m. Eastern time on 22 October, it said, it had found no evidence that personal information or ad delivery data had leaked.
The company says the new case is being handled separately and has not said how, or whether, the two are linked. Its 22 October notices did not mention points or rewards; the 1 November update is the first to say a third party carried out unauthorised operations on those systems.
Why a rewards ledger needs the same guard as a bank
Two intrusions in nine days will raise the obvious question of whether the first was fully closed. SmartNews has not answered it, and its statement that the cases are separate is all there is to go on. What the company has disclosed points to a sensible order of response: take systems offline, cut off credentials, freeze the thing of value and then work out the scope.
The points system is where that matters most. Rewards points can be exchanged for things of value, which makes a loyalty ledger a target in its own right even when no personal data is taken. TSN has reported a similar pattern in finance, where Iwai Cosmo Securities said attackers placed trades its customers did not make. The lesson carries over: when an attacker can change balances or trigger transactions, a freeze on redemptions is the quickest way to stop losses while records are checked.
From a compliance view, the gap to watch is personal data. Under Japan’s personal information law, a leak caused by unauthorised access has to be reported to the regulator and the people affected have to be told. SmartNews has so far said only that it is checking accounts and advertising information. App operators that have faced this question, such as Burger King Japan and So-net, later published counts of the records involved. Until SmartNews does the same or rules it out, users should treat the SmartNews security incident as unresolved and watch their points activity.
The next update should settle the data question
SmartNews says it will post further updates as its investigation progresses. The key one for the SmartNews security incident will say whether any user accounts were affected and whether any personal or advertising data left its systems, and when point redemptions can resume.
Sources
Primary:
- SmartNews: Notice Regarding Our Response to a Security Issue (Update: As of 1:00 a.m. EST, November 1, 2026)
- SmartNews: セキュリティ上の問題への対応について（続報：2026年11月1日15時時点）
- SmartNews: Notice Regarding Our Response to a Security Issue (October 31, 2026)
- SmartNews: Notice Regarding Our Response to a Security Issue, 22 October 2026
- SmartNews: Core Services Restored, 23 October 2026
- SmartNews Help Center: security issue update, 1 November 2026
Related stories
- Iwai Cosmo Securities Says Cyberattack Placed Trades Customers Did Not Make
- Burger King Japan Says About 11.18 Million App Member Records Leaked After Unauthorised Access
- So-net Says Hack Exposed 2.59m Records and 54,401 Mail Passwords
Image: wu yi takeshi2 / Wikimedia Commons, CC0, modified by TSN
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
.jpg){kind=link}
