Incident BriefingsOWNLY campaign participant data incident

OWNLY campaign participant data incident

OWNLY disclosures identified leaked MOS and Kirin campaign records, while the public notices left some October chronology unresolved.

Last modified

Summary

  • Environment: OWNLY social-media campaign participant records
  • Operational impact: Affected access blocked and accounts disabled
  • Financial impact: No confirmed incident cost quantified
  • Record status: Developing record. Reviewed November 11, 2026; updated as evidence emerges.

What happened

Smart Share disclosed unauthorized access to its OWNLY campaign platform in October 2026. Kirin Brewery and Kirin Beverage later confirmed exposure of their campaign participants’ information. [1][2]

Impact

The provider’s October notice covered 14,034 MOS campaign records, including social identifiers and entry or coupon status. Those campaigns did not collect contact addresses, card data or social-network passwords. [2]

Kirin’s November notice identified 1,825 records, including 329 classified as personal information. Fields were LINE display names or X usernames. The campaign counts are not a combined unique-person total. [1]

Timeline

  1. Provider detects intrusion

    Smart Share says monitoring detected an upload-path intrusion.

    [2]

  2. Provider publishes campaign findings

    The notice described three MOS campaigns.

    [2]

  3. Briefing updated

    This briefing was last reviewed and updated on November 11, 2026.

Threat Group & Attack Vector

Smart Share identified a file-upload defect and delayed developer awareness caused by alert configuration. Kirin separately dates OWNLY access confirmation to October 18; the notices do not reconcile those milestones or establish Kirin’s specific entry path. [1][2]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

Response

Smart Share fixed upload restrictions and alerts. Kirin identified access traces October 28, confirmed leakage November 6 and disclosed it November 10. Affected accounts were disabled and external investigation continued. [1][2]