Incident BriefingsSmartNews points and rewards incident

SmartNews points and rewards incident

SmartNews confirmed unauthorized access between October 31 and November 1, 2026, explicitly separating it from the incident announced October 22.

Last modified

Summary

  • Environment: SmartNews points, rewards and application systems
  • Operational impact: Rewards suspended; US push notifications restored
  • Financial impact: No incident cost disclosed
  • Record status: Developing record. Reviewed November 3, 2026; updated as evidence emerges.

What happened

SmartNews confirmed unauthorized access between October 31 and November 1, 2026, explicitly separating it from the incident announced October 22. [2]

Impact

Unauthorized operations affected points and rewards. The company suspended redemptions while investigating effects on accounts and advertising-related information. [2]

In its November 2 US-edition update, SmartNews said push notifications were restored and personalization was returning gradually. Missions and point redemptions remained suspended; core reading and refreshing worked normally. [1]

Timeline

  1. Unauthorized access begins

    Unauthorized access begins, as described in the company notice.

    [2]

  2. Separate incident confirmed

    Separate incident confirmed, as described in the company notice.

    [2]

  3. US feature recovery reported

    US feature recovery reported, as described in the company notice.

    [1]

  4. Briefing updated

    This briefing was last reviewed and updated on November 3, 2026.

Threat Group & Attack Vector

The reviewed notice does not establish the initial access method.

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

SmartNews stopped affected systems and began invalidating and rotating credentials. [2]

Advertising continued, with dashboard access restored and remaining advertising features still being recovered. [1]