{
  "id": "smartnews-points-security-incident",
  "url": "https://ohshit.app/incidents/smartnews-points-security-incident/",
  "title": "SmartNews confirms unauthorized operations in its points and rewards systems",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-01",
  "date_is_approximate": false,
  "updated": "2026-11-05",
  "tags": [
    "SmartNews",
    "SaaS",
    "account security"
  ],
  "ecosystems": [],
  "summary": "SmartNews confirms points/rewards tampering after unauthorized access, separate from its October 22 incident. By November 2, push and major advertising functions returned, with personalization recovering gradually. Redemptions and some rewards remain paused; account and advertising-information impact is still being investigated.",
  "splash": "SmartNews points/rewards systems; effects on user accounts and advertising-related systems are still being investigated",
  "wipe": "Check points and rewards activity, report unexplained changes through official support and follow restoration updates",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Check your points and rewards activity",
      "hint": "Use your usual SmartNews app/account route to inspect points and rewards history. Report unexplained changes through the SmartNews Help Center form linked in the original notice; preserve the relevant dates and account records."
    },
    {
      "title": "Account for suspended features",
      "hint": "The November 2 follow-up restores push notifications, phases in personalization and enables missions and point earning; redemptions and some rewards stay paused. Advertising delivery continues and major advertising functions, including management access, have returned while remaining functions recover. Follow the official newsroom: unavailability is not proof of theft, and restoration does not close the account/data investigation."
    },
    {
      "title": "Keep support and recovery on official channels",
      "hint": "Open support.smartnews.com through your established route rather than unsolicited recovery links. The vendor is revoking/updating system credentials; no user password-reset requirement or completed account-impact assessment is published in these notices. Recheck official instructions if that changes."
    }
  ],
  "sources": [
    {
      "name": "SmartNews first November 1 notice",
      "url": "https://about.smartnews.com/ja/news/2615.html",
      "primary": true
    },
    {
      "name": "SmartNews detailed November 1 follow-up",
      "url": "https://about.smartnews.com/ja/news/2617.html",
      "primary": true
    },
    {
      "name": "SmartNews November 2 partial-restoration notice",
      "url": "https://about.smartnews.com/ja/news/2619.html",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "SmartNews confirms third-party access and unauthorized points/rewards operations.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 31–Nov 1, 2026",
      "title": "Unauthorized access to part of SmartNews systems occurs"
    },
    {
      "date": "Nov 1, 2026",
      "title": "SmartNews announces feature suspensions and confirms points/rewards tampering",
      "body": "Affected systems were stopped and credential revocation/replacement is underway; account and advertising impact remain under investigation."
    },
    {
      "date": "Nov 2, 2026",
      "title": "Push notifications and major advertising functions return; point redemptions remain paused",
      "body": "The November 2 notice restores push notifications, phases in personalization and allows missions and point earning. Redemptions and some rewards remain paused. Major advertising functions, including management access, have returned; remaining recovery and impact investigation continue."
    }
  ],
  "body_markdown": "The November 1 follow-up explicitly distinguishes this case from the October 22 security issue. It confirms unauthorized operations in the points/rewards systems, not a measured theft total or a confirmed personal-data leak. Advertising delivery continues, while effects on advertising systems and information are being checked. The vendor says affected systems have been stopped and authentication credentials are being revoked and renewed. It has not published an entry point, affected-user count or complete restoration date.\n\nAccount-level investigation remains open despite the containment work.\n\nOn November 2, the company reported partial restoration: push notifications and major advertising functions, including management access, returned; personalization was returning gradually and missions/point earning were available. Point redemptions and some rewards stayed paused. Basic news reading and updates were available; neither full recovery nor a completed impact assessment follows from this notice."
}