--- title: "OWNLY campaign participant data incident" description: "OWNLY disclosures identified leaked MOS and Kirin campaign records, while the public notices left some October chronology unresolved." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-11-11" canonical_url: "https://www.ally.security/incidents/ownly-campaign-participant-data-incident-2026" markdown_url: "https://www.ally.security/incidents/ownly-campaign-participant-data-incident-2026.md" stix_url: "https://www.ally.security/incidents/ownly-campaign-participant-data-incident-2026/stix.json" --- # OWNLY campaign participant data incident OWNLY disclosures identified leaked MOS and Kirin campaign records, while the public notices left some October chronology unresolved. Last modified Nov 11, 2026 · 2 sources ## Summary - **Environment:** OWNLY social-media campaign participant records - **Operational impact:** Affected access blocked and accounts disabled - **Financial impact:** No confirmed incident cost quantified ## What happened [Smart Share](https://www.smartshare.jp/) disclosed unauthorized access to its OWNLY campaign platform in October 2026. [Kirin Brewery and Kirin Beverage](https://www.kirinholdings.com/) later confirmed exposure of their campaign participants’ information. [1](#source-1) [2](#source-2) ## Impact The provider’s [October notice](https://www.smartshare.jp/news/20261027) covered **14,034 MOS campaign records**, including social identifiers and entry or coupon status. Those campaigns did not collect contact addresses, card data or social-network passwords. [2](#source-2) Kirin’s [November notice](https://www.kirinholdings.com/jp/newsroom/release/2026/1110_03.pdf) identified **1,825 records**, including 329 classified as personal information. Fields were LINE display names or X usernames. The campaign counts are not a combined unique-person total. [1](#source-1) ## Timeline ### October 16, 2026 — Provider detects intrusion Smart Share says monitoring detected an upload-path intrusion. [2](#source-2) ### October 27, 2026 — Provider publishes campaign findings The notice described three MOS campaigns. [2](#source-2) ### November 11, 2026 — Briefing updated This briefing was last reviewed and updated on November 11, 2026. ## Threat Group & Attack Vector Smart Share identified a file-upload defect and delayed developer awareness caused by alert configuration. Kirin separately dates OWNLY access confirmation to October 18; the notices do not reconcile those milestones or establish Kirin’s specific entry path. [1](#source-1) [2](#source-2) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - [T1190 — Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/): the provider documented exploitation of its upload function. [2](#source-2) ## Response Smart Share fixed upload restrictions and alerts. Kirin identified access traces October 28, confirmed leakage November 6 and disclosed it November 10. Affected accounts were disabled and external investigation continued. [1](#source-1) [2](#source-2) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Kirin OWNLY campaign participant data notice official · Kirin Brewery and Kirin Beverage · Nov 10, 2026 ### Smart Share OWNLY campaign participant data notice official · Smart Share · Oct 27, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** OWNLY campaign participant data incident: Provider detects upload-path intrusion 2. **Resulted In · 100% confidence · current** OWNLY campaign participant data incident: Kirin publishes downstream findings 3. **Used Attack Technique · 100% confidence · current** OWNLY campaign participant data incident: https://attack.mitre.org/techniques/T1190/ 4. **Resulted In · 100% confidence · current** OWNLY campaign participant data incident: Kirin had not confirmed leakage of email addresses, passwords, phone numbers, postal addresses or credit-card data, and had not confirmed secondary misuse. 5. **Resulted In · 100% confidence · current** OWNLY campaign participant data incident: The October 27 provider notice identified 14,034 leaked participant records across three MOS campaigns, including social usernames/IDs, entry times and lottery or coupon status. It did not establish a provider-wide unique-person total. 6. **Occurred At · 100% confidence · current** Provider detects upload-path intrusion: 2026-10-16 7. **Resulted In · 100% confidence · current** OWNLY campaign participant data incident: Kirin confirmed 1,825 leaked campaign records containing LINE display names or X usernames, including 329 classified as personal information. The remainder 1,496 were not classified as identifying information. These figures are not added to the earlier MOS campaign count. 8. **Processor For · 100% confidence · current** Smart Share: Kirin Brewery 9. **Processor For · 100% confidence · current** Smart Share: Kirin Beverage 10. **Resulted In · 100% confidence · current** OWNLY campaign participant data incident: The MOS campaigns did not collect names, postal or email addresses, phone numbers, card data or social-network passwords. The provider then reported no evidence of access to other campaigns. 11. **Occurred At · 100% confidence · current** Provider publishes MOS campaign findings: 2026-10-27 12. **Affected Organization · 100% confidence · current** OWNLY campaign participant data incident: Smart Share 13. **Occurred At · 100% confidence · current** Kirin publishes downstream findings: 2026-11-10 14. **Occurred At · 100% confidence · current** Kirin confirms campaign-data leakage: 2026-11-06 15. **Resulted In · 100% confidence · current** OWNLY campaign participant data incident: Kirin confirms campaign-data leakage 16. **Resulted In · 100% confidence · current** OWNLY campaign participant data incident: Provider publishes MOS campaign findings 17. **Affected Organization · 100% confidence · current** OWNLY campaign participant data incident: Kirin Beverage 18. **Resulted In · 100% confidence · current** OWNLY campaign participant data incident: Smart Share corrected upload restrictions and alert settings, inspected accounts and asked customer organizations to change passwords and configure multifactor authentication and IP restrictions. 19. **Affected Organization · 100% confidence · current** OWNLY campaign participant data incident: Kirin Brewery 20. **Resulted In · 100% confidence · current** OWNLY campaign participant data incident: Kirin blocked access and disabled affected accounts, preserved logs and pursued external investigation; privacy-authority reporting and further prevention measures were planned. 21. **Resulted In · 100% confidence · current** OWNLY campaign participant data incident: Kirin separately dated OWNLY unauthorized-access confirmation to October 18; it found traces affecting its campaigns October 28 and confirmed leakage November 6. The public notices do not reconcile the October 16 and 18 milestones or establish the Kirin-specific entry path. 22. **Resulted In · 100% confidence · current** OWNLY campaign participant data incident: Smart Share said monitoring detected unauthorized access through a file-upload defect early October 16. Misconfigured alerts delayed developer awareness, but the entry path was blocked that day. 23. **Disclosed At · 100% confidence · current** OWNLY campaign participant data incident: 2026-10-27