For: Netmile and Sugutama members, including people who have left. This article is an explanation based on official announcements by Wills Inc.; it does not cover attack methods.
Developing: this article will be updated as the organisation publishes more
- Who is affected
Netmile and Sugutama members, including people who have left.
- Confirmed so farSee the table ↓
- Unauthorized access by a third party
- Held miles
Listed as possibly affected
- Number of people
- Name and email address
- Other information related to reward exchange
- Not yet confirmed
- Date of the access, date of detection and cause
- Scope of the leak and the actual number of people
- What exactly 'other information related to reward exchange' includes
2 more
- When the service will restart
- Whether the data has been misused
- What to do nowSee the steps ↓
- Do not respond to contact in the name of Netmile or exchange partners
- Wait for individual contact, and check the sender of any email you receive
- Do not take any action on your miles yourself
3 more
- Change the password on services where you reused your Netmile password
- If an already-exchanged gift cannot be used, contact the dedicated desk
- If you entered information or responded to suspicious contact, get help quickly
- Where to verify (source)All sources ↓
- Wills Inc., "Notice regarding the possible leak of personal information due to unauthorized access to Netmile" (November 2, 2026, PDF, in Japanese)
- Last checked
- As of November 13, 2026
Follow-up plans and what we checked
Wills says it is investigating the cause and scope and will notify affected members as the investigation progresses. On the Personal Information Protection Commission, it says it will respond appropriately in line with the relevant laws. When we checked the company's IR news and Netmile's notice on November 13, 2026, we found no follow-up after the November 2 announcement.
What members should do today
Do not respond to contact in the name of Netmile or exchange partners
The company says suspicious emails, texts and calls pretending to be the company, financial institutions or exchange partners may arrive. Do not open URLs in such contact, and do not enter passwords or PINs. The Netmile site is suspended, so even a message that says "log in to check" should not be followed; open the official notice yourself instead. Ways to tell the difference are in What is phishing?.
Wait for individual contact, and check the sender of any email you receive
Netmile's notice says it will contact members individually, in turn, at the email address they registered. Do not open links in such an email; check its content against the official Netmile notice (a notice on www.netmile.co.jp). The notice carries no date, so we checked it on November 13.
Do not take any action on your miles yourself
According to Netmile's notice, the company guarantees held miles and will restore them after the restart. Miles will not expire during the suspension, even if the expiry date passes. No action is needed from you on held miles for now, and exchanges already accepted generally do not need to be applied for again. Be wary of contact that says "your miles will disappear unless you act", because it contradicts this guidance.
Change the password on services where you reused your Netmile password
Passwords are not among the listed items (not stated). However, the notice does not say what the information related to reward exchange contains. If you used the same email address and password combination on other services, change it as a precaution and turn on two-step verification. Steps are in How to check whether your password has leaked and A guide to multi-factor authentication.
If an already-exchanged gift cannot be used, contact the dedicated desk
For gifts you have already exchanged, such as Amazon gift cards, V Preca and QUO Card Pay, the notice tells you to contact the dedicated inquiry desk listed in Netmile's notice if you cannot use them. It says the company will respond individually after checking.
If you entered information or responded to suspicious contact, get help quickly
If you entered a password or card information on a link in suspicious contact, change the password on that service, and contact your card company or bank and check your statement. Also consult your local police or consumer hotline. For suspicious account activity, see How to check for unauthorized access.
What happened (from Wills' announcements)
On November 2, 2026, Wills announced the incident in its IR news. Netmile's site also carries a notice titled "Important: notice and apology about the service suspension due to unauthorized access". Everything below is from the company's announcements.
No date stated
A third party gained unauthorized access to Netmile's system environment. The date of the access and the date of detection have not been disclosed.November 2
Wills announced that some members' personal information may have leaked, and said it had suspended the Netmile and Sugutama sites.
- Company
- Wills Inc. (runs Netmile in its advertising business)
- Scope
- Up to about 5.49 million people (maximum, including information of members who have left)
- Information that may have leaked
- Name, email address and other information related to reward exchange. The type of information stored differs by member
- Information not held
- Credit card information, My Number Card information and similar
- Cause
- Unauthorized access by a third party to Netmile's system environment. The date, detection date and route have not been disclosed
- Service status
- Netmile and Sugutama suspended. Mile exchange acceptance and crediting, and exchanges already accepted, are also suspended (Netmile's notice). Restart date not decided
- Effect on other businesses
- Run on a different system base from its shareholder management platform business. Premium Yutai Club, IR-navi and IR-port: no effect confirmed so far, available as usual
What is known and what is not
This table is based on the company's announcements (Wills' November 2 announcement and Netmile's notice) as of November 13, 2026. We will rewrite the status column when there is a follow-up.
| Item | What the announcement says | Status |
|---|---|---|
| Unauthorized access by a third party | Occurred against Netmile's system environment | Confirmed (company) |
| Date of access and detection | Not stated | Not stated |
| Route and cause | Not stated. Under investigation | Under investigation |
| Number of people | Up to about 5.49 million (maximum, including former members) | Possible (company; an upper limit) |
| Name and email address | Among the items that may have leaked | Possible (company) |
| Other information related to reward exchange | Specific items not stated. Type differs by member | Possible (company) |
| Credit card information and My Number Card information | Not held | Not included (company) |
| Passwords | Not listed as an item | Not stated |
| Publication or spread on the internet, and misuse | Not confirmed so far | Not confirmed (company) |
| Held miles | The company guarantees them and will restore them after the restart; no expiry during the suspension | Confirmed (Netmile's notice) |
| Restart date | Not decided | Under investigation |
| Report to the Personal Information Protection Commission | Says it will respond appropriately under the relevant laws; does not say a report has been made | Not stated |
| Individual notification to affected members | Says it will contact members in turn at their registered email address | Planned (company) |
What names, email addresses and exchange information can be used for
The table below describes what can generally happen with combinations of these items. It does not mean this has happened in this incident.
| Items that may have leaked | What can generally happen | What members should do |
|---|---|---|
| Name + email address | Genuine-looking emails in the name of Netmile or exchange partners, and login lures about "miles expiring" | Do not open links; open the official notice yourself |
| Email address | The same email and password combination is tried on other services | Do not reuse passwords; use two-step verification |
| Reward exchange information (such as exchange partners and amounts; contents not disclosed) | Contact about gift exchange or cashing out, or contact in the name of a financial institution | Verify any exchange-related contact through an official channel |
What can happen with the information that may have leaked
- Genuine-looking emails, texts and calls in the name of Netmile, banks or exchange partners
- Lures to fake sites using "miles expiring" or "restart procedures"
- Attempts to log in to services where the same password was reused
Reported as not held in the announcement
- Credit card information
- My Number Card information
What operators should review: how long to keep former members' information
The cause has not been disclosed, so this section only covers what can be said from the published facts.
- Decide why you keep former members' information: the up to about 5.49 million people include members who have left. If names and email addresses are kept after withdrawal, a breach affects people who no longer use the service. Deciding which items to keep after withdrawal and for how long, and deleting or tightly separating what is no longer needed, can reduce what leaks (our view).
- Announce the suspension and the member guidance together: the company suspended the sites and, on Netmile's site, explains that held miles are guaranteed and will not expire. Answering users' worry during a suspension (what happens to my points?) at the same time as the incident announcement makes it harder for fake messages saying "it will disappear unless you act" to take hold (our view).
Sources (public record)
The facts in this article are based on the official announcements below. We do not speculate about cause details that have not been disclosed.
- Wills Inc., "Notice regarding the possible leak of personal information due to unauthorized access to Netmile" (November 2, 2026, PDF, in Japanese) — wills-net.co.jp
- Wills Inc., IR news (list, in Japanese) — wills-net.co.jp
- Netmile, "Important: notice and apology about the service suspension due to unauthorized access" (no date stated; checked on November 13, 2026, in Japanese) — netmile.co.jp
Update history
2026-11-13: First version. Based on Wills' announcement of November 2 and Netmile's notice. We checked the official IR news and the notice the same day and found no follow-up.
Read next
- How to spot fake contact: What is phishing? / Smartphone security basics
- Password reuse: How to check whether your password has leaked / A guide to multi-factor authentication
- Suspicious activity on an account: How to check for unauthorized access
- Other incidents in 2026: Data breaches and cyberattacks (Japan and overseas)