Wills Inc. (株式会社ウィルズ), a Tokyo Stock Exchange Growth-listed company, said on 2 November 2026 that a third party gained unauthorized access to the system environment behind NetMile, its points-exchange service. Personal information on up to about 5.49 million current and former members may have leaked. Every outlet covering the incident uses the same figure: Japanese broadcaster NHK, IT Post, the breach tracker 情報漏えい.jp, TRAICY, Terminair and SmartScope all cite 5.49 million, and all of them trace it to the company's own disclosure notice. Wills describes the figure as a maximum, not a confirmed count of leaked records. The company has taken the NetMile and Sugutama sites offline. It says it has seen no sign that the data has been published or misused.
What Happened
Wills announced the incident in a notice titled "Notice Concerning Potential Leak of Personal Information Due to Unauthorized Access in 'NetMile'". IT Post and SmartScope both reference this notice. The wording matters. As IT Post points out, the notice describes a possible leak. Other Japanese companies disclosing around the same time, such as Nojima and @cosme, announced confirmed leaks.
Here is what Wills has said so far:
- Scope: The access happened inside the NetMile system environment, which Wills runs as part of its advertising business. NetMile started out in a former subsidiary. Wills says it runs on separate infrastructure, with separate administrative permissions, from the company's main shareholder-management platform business.
- Core services: Wills says it has found no leak or service disruption affecting Premium Yutai Club, IR-navi or IR-port, and these services are running normally.
- Containment: The NetMile and Sugutama (すぐたま) sites are suspended "to prevent secondary damage and strengthen security." TRAICY's English report spells the second site "Sugotama". The Japanese name is すぐたま.
- Regulatory steps: Wills says it will notify affected members and report the incident to Japan's Personal Information Protection Commission as the law requires.
- Financial impact: Wills expects only a minor effect on its results for the fiscal year ending December 2026.
- Members' miles: SmartScope reports that the company has promised members their miles balances will be kept while the sites are down.
Wills has not said when the intrusion began or when it was found. 情報漏えい.jp lists the detection, initial response, investigation findings and prevention measures stages of its timeline as blank. Only the 2 November disclosure date is filled in. The company says its investigation into the cause and extent is still going on.
Watch the name. A separately named company, 株式会社ウィル (Will Co., Ltd., a real estate firm), published its own notice on 6 November about a different incident. That breach came from its email delivery provider, Arara Inc. ("Arara Message"), and exposed 102,369 email addresses (the count includes duplicates) and one person's name. Will Co. says this was a supply-chain exposure through Arara. No source links it to the NetMile intrusion. It is a different company and a different incident. Readers should not mix the two up.
What Was Taken
Wills lists the data that may have been exposed:
- Names
- Email addresses
- Other information related to reward exchanges
Two caveats in the company's notice affect how far the exposure reaches:
- The 5.49 million figure is a ceiling. It includes members who have already closed their accounts. IT Post stresses that it does not mean data on all 5.49 million people was confirmed stolen.
- The stored data varies from member to member. Some people's records hold more fields than others.
Wills says NetMile did not hold credit card data or My Number (Japan's national ID) card information. The notice does not say whether passwords, phone numbers, postal addresses or partner-linked account identifiers were stored or exposed. NetMile lets users turn points into e-money and other rewards (NHK, via JPO's translation). That suggests the "reward exchange" records may link members to their accounts with outside partners. Wills has not confirmed this.
IT Post makes a sharper point. Whether the data actually leaked is still an open question, but the fact that former members' data was still being kept is not. Wills's own disclosure confirms it.
Why It Matters
Kept data adds to the damage. Members who left the service are part of the affected group. For defenders and privacy teams, this is a familiar problem: data kept after an account closes has no business value but is just as exposed as live data. A retention and deletion policy for closed accounts would have shrunk the exposure.
Inherited systems are a weak point. NetMile came from a former subsidiary and runs on its own infrastructure. Wills presents that separation as the reason its core services are safe, and the separation may well have limited the damage. But inherited business units with their own systems often get less security investment and monitoring than the main platform. That makes them easier targets.
The data is well suited to phishing. Names, email addresses and reward-exchange history let an attacker write believable lures. A message can mention a real points balance or a real partner, or claim to be about this very breach. Wills's own warning names the expected pretexts: fake emails, SMS messages and calls posing as Wills, a financial institution or a reward-exchange partner.
It is part of a wider pattern in Japan. Super Sonic Design reports a run of breaches at Japanese member and app-account systems disclosed from September to October 2026. Record counts ranged from about 900,000 to more than 10 million, and most involved names, email addresses and phone numbers. JPCERT/CC issued advisory JPCERT-AT-2026-0030 on 8 October and updated it on 23 October. The advisory covers unauthorized access against organizations in Japan. Super Sonic Design says it found no official statement of a shared cause or a single attacker behind these incidents. NetMile should not be assumed to belong to the same campaign.
The Attack Technique
Not disclosed. Wills has not said how the attacker got in, which component was compromised, or how long the access lasted. No attacker has publicly claimed the breach. As of the announcement, Wills says it has found no sign that the data has been posted or spread online.
For context only: JPCERT/CC's advisory, as Super Sonic Design summarizes it, lists five methods seen in recent intrusions at Japanese organizations:
- scanning for known vulnerabilities
- abuse of APIs
- exploitation of a Metabase vulnerability
- web shell placement
- misuse of AI penetration-testing platforms
JPCERT/CC also tells organizations to check BI tools and internal admin systems, not just the apps the public uses. None of these methods has been tied to the NetMile incident. They are a sensible starting list for any organization running a similar member platform.
What Organizations Should Do
- Audit inherited and legacy systems. List every system that came with an acquisition, an ex-subsidiary or an old product line. Bring each one up to the same patching, logging and access-review standard as the main platform. If a system can't be maintained to that standard, retire it.
- Delete data from closed accounts on a schedule. Set retention periods for former members' data and enforce them with automatic purging or anonymization. When someone closes an account, delete their data unless a law requires you to keep it.
- Work through JPCERT/CC's advisory. Scan member-facing apps for known vulnerabilities. Review API authentication and rate limits. Patch or isolate BI tools such as Metabase. Look for web shells on web-facing servers.
- Check internal tools and admin panels. Restrict access to employee-facing admin consoles and analytics tools, and watch them closely. Use network allowlists, MFA and logging, since JPCERT/CC flags these tools as targets.
- Prepare for phishing that cites the breach. If you are a reward or payment partner of an affected platform, warn your customers ahead of time. Watch for lookalike domains and for SMS or email campaigns that use the incident as a hook.
- Make sure segmentation claims hold up. Wills says separate infrastructure and admin permissions protected its core services. Test that your own environments really are separated: shared credentials, shared identity providers or shared admin accounts would undo it.
Sources: Wills says up to 5.49 million NetMile members' data may have leaked... | NetMile: Up to Approximately 5.49 Million Users' Personal Data Pote... | NetMile Nhật Bản: 5,49 triệu người nguy cơ lộ dữ liệu | ネットマイルに不正アクセス、最大約549万人の漏えいの可能性。退会した人の情報も含む最大数で、2サイトは停止中｜IT Post | Breaches of Member Systems Keep Coming: What the Disclosed Incident... | Possible Leak of Personal Information Affecting Up to 5.49 Million... | お知らせ【第3報】アララ株式会社への不正アクセスに伴うお客様情報の流出について｜企業情報 - 株式会社ウィル | 株式会社ウィルズ（ネットマイル（すぐたま））の個人情報漏えいのおそれ（2026年11月2日公表） 情報漏えい.jp