SmartNews said on 6 November 2026 that unauthorised access on 31 October may have leaked some personal information it holds. The catalog entry records three published buckets: 1,582 publisher-contact emails, 207 advertising-partner emails, and 1,033 internal user IDs that the company says cannot identify a person on their own. Passwords, payment cards and other high-risk fields were not included. No misuse had been confirmed. The three numbers add to 2,822 records. That is not 2,822 unique readers of the app.
The 31 October access is separate, SmartNews said, from a security issue it had already announced on 22 October. On 1 November it reported that a third party had run unauthorised operations on points and rewards, paused redemptions, and taken some personalization, push and rewards features offline. A 4 November US-edition update said push was back, personalization was returning, and missions and rewards remained off. The 6 November notice is the personal-information finding from that same 31 October access, not a second attack.
What happened in the SmartNews data breach?
A third party reached systems SmartNews operates on 31 October 2026. The company took affected systems offline and began rotating credentials. While it looked at impact on points, ads and the consumer app, the later investigation found that some stored personal information may have left. Publisher tools and the ads business hold work emails for counterparties. The consumer app holds internal IDs for a slice of users. Those are the three files named on 6 November.
This is a confirmed company notice with a small, split census. It is not a dump of the whole SmartNews reader base. It is closer in shape to the Who Gives A Crap vendor notice (contact data, no cards) than to a payments PAN leak such as Gnosis Pay. The useful fact for a reader of the app is the 1,033 internal IDs, which SmartNews says are not standalone identifiers. The useful fact for a publisher or ads buyer is the work-email buckets, which are large enough to fuel spear-phishing that quotes a real media partnership.
Do not add the 1,582, 207 and 1,033 figures into one "2,822 people affected" headline in a way that implies 2,822 named humans. The first two buckets are emails. The third is internal IDs. A publisher contact could appear in more than one system. SmartNews did not publish a deduplicated people count.
What data was exposed?
Publisher contacts: email addresses, 1,582 records. Advertising-service contacts: email addresses, 207 records. SmartNews users: internal user IDs, 1,033 records, described as IDs used only inside SmartNews systems. The company confirmed the take does not include passwords, credit-card information, or other information it classes as high risk of misuse. Names, phone numbers and home addresses are not listed for the consumer-user bucket.
A work email plus knowledge that the person runs a SmartNews publisher integration is enough for a fake "restore your feed" message. An internal user ID without a name is a weaker handle. It still should not be pasted into random "account recovery" pages.
Who is affected?
People in those three buckets. Most SmartNews readers are not in the 1,033. Publisher and ads counterparties who used SmartNews systems are the people who should expect a letter. SmartNews said it will contact affected parties in sequence. US media partnerships should use partners@smartnews.com. Ads partners have a Zendesk form. App users have the Help Center. If you only read articles in the app and received no notice, you are probably outside the user-ID slice.
What should I do?
- If you are a publisher or ads contact, watch for the official notice. Do not type a password into a mail that claims to be SmartNews security. The company says it will not ask for a password by email or phone.
- Treat unexpected SmartNews points, partnership or invoice mail as hostile until you open the official site yourself.
- App users: check points and rewards for activity you did not start, as the 1 November post asked. Rewards remained paused in the 4 November US update.
- You do not need a credit freeze solely because an internal app ID or a work email was listed. You do need to assume spear-phishing against publisher inboxes.
- Keep the 6 November notice. If SmartNews later adds names or a people census, that update changes the risk.
The Who Gives A Crap vendor post is the same practical rule for a contact-only file: keep the letter, ignore copycat refund mail, do not invent a million-person count.
Frequently asked questions
Were reader passwords leaked?
SmartNews says passwords and credit-card information were not included. The user bucket is internal IDs only.
Is this the 22 October SmartNews issue?
No. The company said it is handling the 31 October access separately from the 22 October issue.
Why did some app features stop?
As a precaution after the 31 October access: points redemptions, then push and personalization. Push was later restored. Rewards stayed paused in the 4 November US note.
How many people were affected?
There is no official unique-people total. There are 1,582, 207 and 1,033 records in three buckets.
Should I delete the SmartNews app?
The notice does not ask you to. Watch points activity and official mail. Deleting the app is optional, not a required step in the company post.
Sourcing note: the three buckets, the no-password line and the 31 October date come from SmartNews's 6 November notice. Feature-outage detail comes from the 1 November and 4 November status posts.