SmartNews confirms unauthorized operations in its points and rewards systems
SmartNews confirms unauthorized access on October 31–November 1 and tampering with points/rewards systems. Redemptions and some features are paused; account and advertising-system impact remain under investigation. The company says this is separate from its October 22 incident.
- Disclosed
- Nov 1, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- SmartNews points/rewards systems; effects on user accounts and advertising-related systems are still being investigated
- SmartNews · SaaS · account security
- In the wild
- Yes
- SmartNews confirms third-party access and unauthorized points/rewards operations.
What happened
The November 1 follow-up explicitly distinguishes this case from the October 22 security issue. It confirms unauthorized operations in the points/rewards systems, not a measured theft total or a confirmed personal-data leak. Advertising delivery continues, while effects on advertising systems and information are being checked. The vendor says affected systems have been stopped and authentication credentials are being revoked and renewed. It has not published an entry point, affected-user count or complete restoration date.
Account-level investigation remains open despite the containment work.
Crime-scene timeline
Oct 31–Nov 1, 2026
Unauthorized access to part of SmartNews systems occurs
Nov 1, 2026
SmartNews announces feature suspensions and confirms points/rewards tampering
Affected systems were stopped and credential revocation/replacement is underway; account and advertising impact remain under investigation.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.