NetMile and Sugutama suspend service: miles, redemptions and steps you can take

What happened: unauthorized access and service suspension

On November 2, 2026, WILLS Inc. announced unauthorized access to NetMile's system environment and the possible leakage of some member information. The cause and scope remain under investigation. NetMile and Sugutama have been taken offline to prevent further harm and implement security measures. See WILLS' official announcement (November 2, 2026, PDF in Japanese).

The announcement identifies NetMile's environment as the target of unauthorized access. Sugutama's suspension does not establish that its own systems were also breached.

Information that may have been exposed, and what remains unknown

The announcement identifies names, email addresses and information relating to reward redemption as potentially affected. Up to approximately 5.49 million members, including former members, could be involved; the information held differs by member. This is an upper limit, not confirmation that every member's information was leaked.

The operator says it does not hold credit card information and, at the time of the announcement, had not confirmed online publication or distribution of the affected information, or harm caused by its misuse. The announcement we checked does not explicitly identify passwords as leaked. No confirmed misuse does not mean that future misuse is impossible.

The service notice says members will be contacted individually at their registered email addresses in stages. Even if you receive a message, do not rely on the sender's displayed name alone; verify the information through the official site.

Existing miles, expiry dates and pending redemptions

The following summarizes the operator's stated commitments and handling policy. It does not mean that recovery has been completed.

Be wary of messages claiming you must sign in to another site or pay a fee to protect your balance. Keep redemption confirmation emails and any existing account records; they may help if you need to contact support.

If a gift you already redeemed cannot be used

The notice directs members whose already-redeemed Amazon Gift Cards, V-Preca, QUO Card Pay or similar gifts cannot be used to the dedicated official support form (Japanese). This is not an announcement that all redeemed gifts are unusable. Do not post gift codes or member details on social media; use the official support channel.

What user authentication cannot prevent, and what we ask of the operator

Protecting member information held by a service provider is the provider's responsibility. A strong password, two-step verification or a passkey alone cannot stop an intrusion into the provider's systems or the theft of stored information. We do not think this incident should be framed as a failure of users' settings or vigilance.

The entry route and cause remain under investigation, so it would also be wrong to assume that a particular authentication method or configuration weakness caused this incident.

Pivox asks for continuing explanations of the cause, scope, member notifications and plans for restoring balances and processing redemptions. Before reopening, the operator should verify safety and review and strengthen safeguards, including access permissions, monitoring and information storage. Explaining preventive measures to the extent possible would also help address members' concerns.

These are our requests to the operator, not findings that any particular safeguard was missing.

What you can do now: watch for scams and stop reusing passwords

Do not act through suspicious emails, texts or phone calls

Watch for messages impersonating the operator, financial institutions or redemption partners. Do not enter or disclose passwords, PINs or verification codes simply because a message claims to offer compensation, protect your miles or verify your identity. Open the official site directly, for example from a bookmark, to check notices and contact details.

If you reuse passwords, change them

Password leakage has not been established in this incident. However, a password reused across services can let credentials leaked elsewhere be used to access another account. Take this opportunity to replace reused passwords on other services with a different, sufficiently long password for each account.

Prioritize the email account used for password resets. Use a password manager where helpful, and consider multi-factor authentication or passkeys on services that support them. Japan's IPA also recommends avoiding password reuse and using multi-factor authentication or passkeys (Japanese).

There is no need to force access to NetMile or Sugutama while they are offline. Change settings for other services through their respective official sites, and follow NetMile and Sugutama's official instructions after reopening.

Use this as an opportunity to review your settings

These steps cannot replace the provider's duty to protect information. They can still help reduce account takeovers and harm spreading to other services. Rather than rushing to respond to alarming messages, review the settings of the services you use, one at a time.

Related Pivox guides

• Moppy password changes and precautions (Japanese)
• Moppy security and authentication
• How to redeem Moppy points

The redemption guide is for Moppy, a separate service. It is not a way to withdraw NetMile miles through Moppy during the suspension.

Updates

• November 3, 2026: Prepared from WILLS' November 2 announcement and the operator's notice. Further information about reopening and investigation results will be added here.