Unauthorized access by a third party was identified at Point Income, the points-rewards website operated by Ceres, and personal information relating to a total of 195 records, comprising 88 members and 107 employees and others, may have been viewed.
On 7 October 2026, Ceres announced that unauthorized access by a third party had occurred in the system for Point Income, its points-rewards website. The investigation found that personal information in some accounts may have been viewed by a third party, affecting a total of 195 records, comprising 88 members and 107 employees and others.
Unauthorized access was detected in the early hours of 5 October, and the company immediately suspended the service and conducted emergency maintenance. It is identifying the cause and carrying out an emergency inspection of the entire system, and has reported the incident to the Personal Information Protection Commission. The specific items viewed and the method of intrusion have not been disclosed at this time.
The web version resumed service at 21:30 on 7 October, while the smartphone app will be released in stages once the work is complete. Members affected will be notified individually by email. The company said that payment-related information was not stored, and therefore there has been no leakage of such information.