Rakuten Rewards
Company Details
Linkedin ID:
rakutenrewards
Website:
Employees number:
489
Number of followers:
15,496
NAICS:
513
Industry Type:
Homepage:
rakuten.com
IP Addresses:
0
Company ID:
RAK_1690246
Scan Status:
In-progress
Rakuten Rewards Company CyberSecurity Posture
rakuten.com
Since our founding in 1997, Rakuten has helped shape the way people shop online, offering Cash Back, deals and shopping rewards on the world’s largest selection of products and services. To date, our 17M members in the U.S. have earned over $4.6B in Cash Back at their favorite stores. We’re the largest free loyalty program in the US and the first-ever jersey badge sponsor of the Golden State Warriors. Rakuten Rewards is headquartered in the San Francisco Bay Area with 12 offices worldwide. Our group of companies includes ShopStyle and Cartera Commerce. Our employees enjoy a fast-paced, friendly environment where creativity and teamwork are valued and results are recognized. Join our team to experience the best of both worlds: a large, profitable, multinational company with the rapid growth and agility of a startup.
Rakuten Rewards A.I CyberSecurity Scoring
Rakuten Rewards Risk Score (AI oriented)Between 700 and 749
Rakuten Rewards
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
Rakuten Rewards Global Score (TPRM)XXXX
Rakuten Rewards
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
Rakuten Rewards Company CyberSecurity News & History
Past Incidents
1
Attack Types
1
Rakuten USA, Inc. DBA Rakuten Americas
Breach
Rankiteo Explanation
Attack with significant impact with internal employee data leaks
Description: On January 21, 2021, Rakuten USA, Inc. (operating as Rakuten Americas) experienced a **data breach caused by insider wrongdoing**, compromising sensitive personal information of **5,390 individuals**. The exposed data included **names, Social Security numbers (SSNs), and dates of birth**—highly sensitive details that significantly increase the risk of identity theft and financial fraud. The breach was formally reported to the **Maine Office of the Attorney General on February 11, 2021**, with at least **one Maine resident directly affected**. In response, Rakuten offered **24 months of complimentary credit monitoring services** to impacted individuals, acknowledging the severity of the exposure. The incident highlights vulnerabilities in internal access controls, as the breach stemmed from malicious or negligent actions by an insider, leading to unauthorized disclosure of personally identifiable information (PII). Such breaches not only erode customer trust but also expose the company to regulatory scrutiny, potential lawsuits, and long-term reputational damage.
Rakuten Rewards Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for Rakuten Rewards
Incidents vs Technology, Information and Internet Industry Average (This Year)
No incidents recorded for Rakuten Rewards in 2025.
Incidents vs All-Companies Average (This Year)
No incidents recorded for Rakuten Rewards in 2025.
Incident Types Rakuten Rewards vs Technology, Information and Internet Industry Avg (This Year)
No incidents recorded for Rakuten Rewards in 2025.
Incident History — Rakuten Rewards (X = Date, Y = Severity)
Rakuten Rewards cyber incidents detection timeline including parent company and subsidiaries
Rakuten Rewards Company Subsidiaries
Since our founding in 1997, Rakuten has helped shape the way people shop online, offering Cash Back, deals and shopping rewards on the world’s largest selection of products and services. To date, our 17M members in the U.S. have earned over $4.6B in Cash Back at their favorite stores. We’re the largest free loyalty program in the US and the first-ever jersey badge sponsor of the Golden State Warriors. Rakuten Rewards is headquartered in the San Francisco Bay Area with 12 offices worldwide. Our group of companies includes ShopStyle and Cartera Commerce. Our employees enjoy a fast-paced, friendly environment where creativity and teamwork are valued and results are recognized. Join our team to experience the best of both worlds: a large, profitable, multinational company with the rapid growth and agility of a startup.
Loading...
Rakuten Rewards Similar Companies
Mynet
Türk internet kullanıcılarının en çok tercih ettiği dijital platform olan Mynet, 1999 yılından bugüne liderliğini koruyor. Kendi alanında sayısız ilki gerçekleştiren öncü internet devi Mynet, Türkiye'nin dijital ekosisteminin kalkınmasına ve gelişmesine destek olmayı sürdürüyor. Her ay ortalama 4
Thirteen-time Webby award-winning Freelancer is the world’s largest freelancing and crowdsourcing marketplace by total number of users and projects posted. More than 80 million registered users have posted over 25 million projects and contests to date in over 3,000 areas as diverse as website develo
SLB
We are a technology company that unlocks access to energy for the benefit of all. As innovators, that’s been our mission for nearly a century. Today, we face a global imperative to create a future with more energy, but less carbon. Our diverse, innovative change makers are focused on going further i
NetEase
As a leading internet technology company based in China, NetEase, Inc. (NASDAQ: NTES and HKEX:9999, "NetEase") provides premium online services centered around content creation. With extensive offerings across its expanding gaming ecosystem, NetEase develops and operates some of China's most popula
Peraton
At Peraton, we're at the forefront of delivering the next big thing every day. We're the partner of choice to help solve some of the world's most daunting challenges, delivering bold, new solutions to keep people around the world safer and more secure. How do we do it? By thinking differently. We'r
Synechron
At Synechron, we believe in the power of digital to transform businesses for the better. Our global consulting firm combines creativity and innovative technology to deliver industry-leading digital solutions. Synechron’s progressive technologies and optimization strategies span end-to-end Artificial
e&
We're a global technology group focused on innovation and collaboration to create a better future for all. Since 1976, we've been pioneering new technologies and expanding our reach to more people and places. Today, we provide services to over 163 million customers across 16 countries in the Middle
Zomato’s mission statement is “better food for more people.” Since our inception in 2010, we have grown tremendously, both in scope and scale - and emerged as India’s most trusted brand during the pandemic, along with being one of the largest hyperlocal delivery networks in the country. Today, Zoma
IndiaMART InterMESH Limited
IndiaMART is India's largest online B2B marketplace, connecting buyers with suppliers across a wide array of industries. IndiaMART provides a platform for Small & Medium Enterprises (SMEs), large enterprises, and individual buyers, helping them access diverse portfolios of quality products. Since
.png)
Rakuten Rewards CyberSecurity News
December 16, 2025 09:24 AM
Rakuten ID Integration Boosts Rewards for Uber Users in Japan
Rakuten and Uber expand their partnership in Japan with Rakuten ID integration, enabling users to earn more Rakuten Points, stack rewards,...
December 04, 2025 08:00 AM
Rakuten And Amex Launch New Credit Card With Up To 10% Cash Back
Rakuten has launched the Rakuten American Express® Card, offering extra cash back on shopping, dining, groceries and more—with no annual...
November 06, 2025 08:00 AM
Bilt and Rakuten Launch Partnership to Power Smart Rewards this Holiday Shopping Season
NEW YORK, November 06, 2025--Holiday shoppers, get ready: Bilt and Rakuten just launched a powerful new partnership that starts TODAY,...
October 01, 2025 07:00 AM
Maritime Leaders recognized at the 2025 SAFETY4SEA Awards
In a prestigious ceremony held on the evening before the SAFETY4SEA Athens Forum, the maritime industry came together to celebrate safety.
July 22, 2025 07:00 AM
Announcing the new Rakuten American Express Card: No annual fee and 4% cash back on Rakuten purchases
Popular cash-back shopping platform, Rakuten, has announced the no-annual-fee Rakuten American Express Card with a stackable 4% cash back on...
May 23, 2025 07:00 AM
Shortlisted nominees announced for the 2025 SAFETY4SEA Awards
The distinguished shortlisted nominees for the 2024 SAFETY4SEA Awards are announced, following an online nomination process.
February 14, 2025 08:00 AM
U.S. Loyalty Programs Market Growth Report 2025: Rakuten and Fetch Rewards have Disrupted Traditional Models by Offering Cashback or Gamified Points Systems, through App-based Loyalty Programs
Over the next few years, subscription-based loyalty programs are expected to intensify, particularly in retail, streaming,...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
Rakuten Rewards CyberSecurity History Information
Official Website of Rakuten Rewards
The official website of Rakuten Rewards is https://www.rakuten.com.
Rakuten Rewards’s AI-Generated Cybersecurity Score
According to Rankiteo, Rakuten Rewards’s AI-generated cybersecurity score is 735, reflecting their Moderate security posture.
How many security badges does Rakuten Rewards’ have ?
According to Rankiteo, Rakuten Rewards currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does Rakuten Rewards have SOC 2 Type 1 certification ?
According to Rankiteo, Rakuten Rewards is not certified under SOC 2 Type 1.
Does Rakuten Rewards have SOC 2 Type 2 certification ?
According to Rankiteo, Rakuten Rewards does not hold a SOC 2 Type 2 certification.
Does Rakuten Rewards comply with GDPR ?
According to Rankiteo, Rakuten Rewards is not listed as GDPR compliant.
Does Rakuten Rewards have PCI DSS certification ?
According to Rankiteo, Rakuten Rewards does not currently maintain PCI DSS compliance.
Does Rakuten Rewards comply with HIPAA ?
According to Rankiteo, Rakuten Rewards is not compliant with HIPAA regulations.
Does Rakuten Rewards have ISO 27001 certification ?
According to Rankiteo,Rakuten Rewards is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of Rakuten Rewards
Rakuten Rewards operates primarily in the Technology, Information and Internet industry.
Number of Employees at Rakuten Rewards
Rakuten Rewards employs approximately 489 people worldwide.
Subsidiaries Owned by Rakuten Rewards
Rakuten Rewards presently has no subsidiaries across any sectors.
Rakuten Rewards’s LinkedIn Followers
Rakuten Rewards’s official LinkedIn profile has approximately 15,496 followers.
NAICS Classification of Rakuten Rewards
Rakuten Rewards is classified under the NAICS code 513, which corresponds to Others.
Rakuten Rewards’s Presence on Crunchbase
No, Rakuten Rewards does not have a profile on Crunchbase.
Rakuten Rewards’s Presence on LinkedIn
Yes, Rakuten Rewards maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/rakutenrewards.
Cybersecurity Incidents Involving Rakuten Rewards
As of December 27, 2025, Rankiteo reports that Rakuten Rewards has experienced 1 cybersecurity incidents.
Number of Peer and Competitor Companies
Rakuten Rewards has an estimated 13,288 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at Rakuten Rewards ?
Incident Types: The types of cybersecurity incidents that have occurred include Breach.
How does Rakuten Rewards detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an remediation measures with offered 24 months of complimentary credit monitoring services to affected individuals, and communication strategy with notification to affected individuals (including at least one maine resident)..
Incident Details
Can you provide details on each incident ?
Title: Rakuten USA, Inc. DBA Rakuten Americas Data Breach (2021)
Description: The Maine Office of the Attorney General reported a data breach by Rakuten USA, Inc. DBA Rakuten Americas on February 11, 2021. The breach occurred on January 21, 2021, due to insider wrongdoing affecting 5,390 individuals, with the compromised data including names, Social Security numbers, and dates of birth. One Maine resident was specifically notified, and Rakuten offered 24 months of complimentary credit monitoring services.
Date Detected: 2021-01-21
Date Publicly Disclosed: 2021-02-11
Type: Data Breach
Attack Vector: Insider Wrongdoing
Threat Actor: Insider
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Breach.
Impact of the Incidents
What was the impact of each incident ?
Incident : Data Breach RAK256082125
Data Compromised: Names, Social security numbers, Dates of birth
Brand Reputation Impact: Potential negative impact due to exposure of sensitive personal data
Identity Theft Risk: High (due to exposure of SSNs and DOBs)
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Personally Identifiable Information (Pii) and .
Which entities were affected by each incident ?
Incident : Data Breach RAK256082125
Entity Name: Rakuten USA, Inc. DBA Rakuten Americas
Entity Type: Corporation
Industry: E-commerce / Technology
Location: USA
Customers Affected: 5390
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Data Breach RAK256082125
Remediation Measures: Offered 24 months of complimentary credit monitoring services to affected individuals
Communication Strategy: Notification to affected individuals (including at least one Maine resident)
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach RAK256082125
Type of Data Compromised: Personally identifiable information (pii)
Number of Records Exposed: 5390
Sensitivity of Data: High (includes SSNs and DOBs)
Personally Identifiable Information: NamesSocial Security NumbersDates of Birth
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Offered 24 months of complimentary credit monitoring services to affected individuals.
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Data Breach RAK256082125
Regulatory Notifications: Reported to the Maine Office of the Attorney General
References
Where can I find more information about each incident ?
Incident : Data Breach RAK256082125
Source: Maine Office of the Attorney General
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Maine Office of the Attorney General.
Investigation Status
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Notification to affected individuals (including at least one Maine resident).
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : Data Breach RAK256082125
Customer Advisories: Notification letters sent to affected individuals, including offer of 24 months of credit monitoring
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Notification letters sent to affected individuals and including offer of 24 months of credit monitoring.
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Data Breach RAK256082125
Root Causes: Insider wrongdoing
Additional Questions
General Information
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident was an Insider.
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2021-01-21.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2021-02-11.
Impact of the Incidents
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were Names, Social Security Numbers, Dates of Birth and .
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Social Security Numbers, Names and Dates of Birth.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 539.0.
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident is Maine Office of the Attorney General.
Stakeholder and Customer Advisories
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued were an Notification letters sent to affected individuals and including offer of 24 months of credit monitoring.
.png)
Latest Global CVEs (Not Company-Specific)
Description
n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy (non-task-runner) JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node. This allows a workflow editor to perform actions on the n8n host with the same privileges as the n8n process, including: reading files from the host filesystem (subject to any file-access restrictions configured on the instance and OS/container permissions), and writing files to the host filesystem (subject to the same restrictions). This issue has been patched in version 2.0.0. Workarounds for this issue involve limiting file operations by setting N8N_RESTRICT_FILE_ACCESS_TO to a dedicated directory (e.g., ~/.n8n-files) and ensure it contains no sensitive data, keeping N8N_BLOCK_FILE_ACCESS_TO_N8N_FILES=true (default) to block access to .n8n and user-defined config files, and disabling high-risk nodes (including the Code node) using NODES_EXCLUDE if workflow editors are not fully trusted.
Risk Information
cvss3
Base: 7.1
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Description
n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this vulnerability to execute arbitrary commands on the host system running n8n, using the same privileges as the n8n process. This issue has been patched in version 2.0.0. Workarounds for this issue involve disabling the Code Node by setting the environment variable NODES_EXCLUDE: "[\"n8n-nodes-base.code\"]", disabling Python support in the Code node by setting the environment variable N8N_PYTHON_ENABLED=false, which was introduced in n8n version 1.104.0, and configuring n8n to use the task runner based Python sandbox via the N8N_RUNNERS_ENABLED and N8N_NATIVE_PYTHON_RUNNER environment variables.
Risk Information
cvss3
Base: 9.9
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Description
LMDeploy is a toolkit for compressing, deploying, and serving LLMs. Prior to version 0.11.1, an insecure deserialization vulnerability exists in lmdeploy where torch.load() is called without the weights_only=True parameter when loading model checkpoint files. This allows an attacker to execute arbitrary code on the victim's machine when they load a malicious .bin or .pt model file. This issue has been patched in version 0.11.1.
Risk Information
cvss3
Base: 8.8
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
n8n is an open source workflow automation platform. Prior to version 1.114.0, a stored Cross-Site Scripting (XSS) vulnerability may occur in n8n when using the “Respond to Webhook” node. When this node responds with HTML content containing executable scripts, the payload may execute directly in the top-level window, rather than within the expected sandbox introduced in version 1.103.0. This behavior can enable a malicious actor with workflow creation permissions to execute arbitrary JavaScript in the context of the n8n editor interface. This issue has been patched in version 1.114.0. Workarounds for this issue involve restricting workflow creation and modification privileges to trusted users only, avoiding use of untrusted HTML responses in the “Respond to Webhook” node, and using an external reverse proxy or HTML sanitizer to filter responses that include executable scripts.
Risk Information
cvss3
Base: 7.3
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Description
Yealink T21P_E2 Phone 52.84.0.15 is vulnerable to Directory Traversal. A remote normal privileged attacker can read arbitrary files via a crafted request result read function of the diagnostic component.
Risk Information
cvss3
Base: 6.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=rakutenrewards' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
