Photo/IllutrationSeven-Eleven Japan Co. President Fumihiko Nagamatsu shows how to use the 7pay smartphone payment system at an outlet in Tokyo's Chiyoda Ward on July 1. (Shimpei Doi)

Seven & i Holdings Co., operator of the nation’s largest convenience store chain, suspended its smartphone payment system after hackers drained the accounts of hundreds of users.

Company officials held a news conference on July 4 and said that about 900 users of the 7pay smartphone payment system, which started on July 1, had been affected as of 6 a.m. on July 4. They suffered damages of about 55 million yen ($510,000).

Tokyo police on July 4 said they had arrested two Chinese men on suspicion of attempted fraud. They were caught in Tokyo’s Shinjuku Ward buying cartons of electronic cigarettes with the 7pay account of another individual, police said.

Seven & i Holdings suspended new deposits into 7pay accounts on the afternoon of July 4 and stopped accepting new accounts. Officials said the measure would remain in place until the cause of the illegal access was determined.

The company will reimburse 7pay users whose accounts were illegally accessed. The system already has about 1.5 million users, so more individuals may be affected.

7pay users will be able to buy items with the amounts already in their accounts, the company said.

Under the system, users deposit funds into their 7pay accounts from registered bank accounts or credit cards. When they buy items at Seven-Eleven Japan Co. convenience stores, they only need to show their smartphone displays with the bar code. Once the bar code is read, the transaction is complete.

The system may have been breached by hackers who had somehow obtained user IDs and passwords for 7pay accounts. Once in an account, they could have made large deposits from the unsuspecting user’s credit card.

Items could then be bought at Seven-Eleven stores through the account.

At the July 4 news conference, Tsuyoshi Kobayashi, president of Seven Pay Co., apologized to users for the damage.

While the cause of the breach is still under investigation, Seven Pay officials said there were signs of illegal access from abroad.

Kobayashi also stressed that tests before the start of the 7pay service did not show any security weaknesses in the system.

One of the Chinese suspects told police that he received a user ID and password through social media. The account belonged to a man in his 40s living in Tokyo.

The two suspects went to a Seven-Eleven outlet in Shinjuku Ward and used the 7pay account to buy 40 cartons of electronic cigarettes worth about 200,000 yen. One of the suspects said he had been instructed to buy the cigarettes, according to police.

The victim noticed that large deposits had been made to his 7pay account and contacted the Seven-Eleven store.

The suspect also told police that he had used the 7pay accounts of seven or eight other individuals to buy 730,000 yen worth of electronic cigarettes.

In Shinjuku, the suspects said they would come back to the store for the cigarettes because the volume was too big for them to handle. When they returned, store workers contacted police.

The car used by one of the suspects had 19 cartons of electronic cigarettes.

Seven Pay officials received inquiries from customers about suspicious transactions on the evening of July 2 and confirmed the illegal actions the next day.

They reported the matter to police on July 4.

(Shimpei Doi contributed to this article.)