Point Income Rewards Site Reports Unauthorized Access; Personal Information on 195 Individuals May Have Been Viewed—88 Members and 107 Employees and Others

CERES INC., which operates the Point Income points site, announced that it had detected suspected unauthorized access by a third party on 7 October 2026. The detections are said to have continued intermittently from the early hours of 5 October, and the service was temporarily suspended to prioritize the protection of customers’ personal information. Details of the technical access route, authentication information and vulnerabilities have not been disclosed, but an investigation was conducted and the relevant authorities were notified.

A total of 195 cases were affected, comprising 88 Point Income member records and 107 records relating to CERES INC. employees and others. CERES INC. said that payment-related information was not included in the leak because it was not stored on the company’s servers. Although the specific personal information items affected have not been disclosed, potentially affected individuals are being notified separately.

Following the unauthorized access, the company suspended the service, inspected all systems and strengthened security. It announced that users may be required to reset their passwords when logging in after the service resumes. The service is scheduled to resume at 21:00 on 7 October, and additional measures to ensure security are expected to be announced for use after the resumption.

Official information on the incident states only that personal information “may have” been viewed. It has not been disclosed whether the information was taken outside the system or used for secondary purposes. Further updates will provide details on the scope of the information disclosed and the specific data items involved.