NewsPicks Data Breach (Card Holder Names and Last Digits, up to 362,000 Records): What Leaked Through an Internal Admin Tool and What Users Should Do

The items that may have leaked include card holder names and the last 3 or 4 digits of card numbers. Genuine messages from card issuers and services often show the last 4 digits so you can recognise your card. That makes a fake message with the correct last digits hard to tell apart from a real one.

If you receive something like "please confirm the card ending in XXXX" or "there is a problem with your payment", do not open the link. Check card matters with your issuer using the number on the back of the card, and NewsPicks matters in the official app (how to spot fakes: What is phishing?).

The company says it began emailing affected users from October 9, in turn, from the NewsPicks support address (no-reply@newspicks.com). However, the sender shown in an email can be faked. Fake emails imitating the notice are possible, so the reliable way to check is the notices on an official site you open yourself.

The company says it will never ask for passwords or credit card numbers by email, text message, phone or post. If you are asked for them, you can treat the message as fake at that point.

According to the company, full card numbers are managed by the payment processor and are not stored on its systems, and it does not store security codes. So the leaked data alone is unlikely to be enough to use the card.

Even so, if a fake message leads you to type in your full card number, that can lead to fraud. If your statement shows a charge you do not recognise, contact your card issuer even if it is small. Decide with your issuer whether to have the card reissued.

The items that may have leaked also include affiliation (such as employer), the phone number of the affiliated organisation and a job-level category. Besides your personal email, calls or emails to your workplace claiming to be NewsPicks or a business partner are possible.

If you are asked to confirm an unexpected bill or "contract details", do not answer on the spot; call back on an official number you look up yourself. Staff managing NewsPicks Enterprise or NewsPicks Education for their organisation should share this warning with users there.

The company says no password leak has been confirmed, and it has not asked users to change passwords. If you are concerned, or you use the same password elsewhere, you can change it in the official app under the account settings in "Settings and privacy" — not via a link in an email (steps on the company's help page Changing your password, in Japanese).

A password manager is the practical way to stop reusing passwords. To see whether your password appears in other leaks, see how to check if your password was leaked.

The contact points in the company's notice are an email address (info@newspicks.com) and the inquiry form in the NewsPicks help centre. You never need to send your card number or password when you contact them.

Admin and analytics tools used only by staff are often treated more lightly than the main service, and nobody may own their updates. Start by listing the admin tools you use and writing down, for each, who updates it and where vulnerability notices arrive (security inventory checklist, CVE remediation playbook).

Only staff should use an admin tool. Use the internal network, a VPN or source-address restrictions so the login page itself cannot be reached from outside. Then route logins through company single sign-on (SSO: one account that signs you in to several tools) and multi-factor authentication.

Some vulnerabilities sit in processing that happens before login, where passwords and MFA do not help. Keeping the tool unreachable from outside is the measure that still works in that case (defending against VPN appliance vulnerabilities).

In general, what can leak from an admin tool is set by the data access you granted it. The company, too, says it reduced the admin tool's data-access permissions to the minimum needed for the work.

In your own environment, write down what data each admin tool's connection user or access key can read, and block fields the work does not need (card holder names, last digits, dates of birth and so on). Using views that expose only part of a table is explained in the Metabase exploitation breaches article; the idea of who may do what is covered in authentication vs authorization.

The company reissued the access keys for data the admin tool could reach. When an admin tool is compromised, the keys it held must be assumed leaked and replaced. Keep a list of which keys are given to which tools, and decide the reissue procedure and who does it in advance, so the response on the day is fast.