EXPLORINEER
en

JP — ITmedia

Denny's App Hit by Unauthorized Access; Fraudulent Credentials Created During Legacy App Migration, Possible Personal Data Leak

Security2 min read

Denny's Japan says a third party got into its Denny's app and may have leaked some users' personal data. The problem happened during the move from the old app to the new one.

What happened

On November 3, Denny's Japan said that hackers had accessed the Denny's app, which handles restaurant coupons and points. During the switch from the old app to the new one, a system step let an outsider create login details without permission. These fake logins let the outsider reach some users' accounts. The company says the number of people affected is still being checked.

Key facts and numbers

  • Possibly leaked: member code, email address, birthday, gender, prefecture of residence, favorite store, and kids' birthday for some users of the old app.
  • Not stored by the company: full name, address, phone number, password, and credit card details.
  • So far, only access records from October 7 have been checked.
  • On October 30, the company found the fake logins. It fixed the system the same day and turned off the fake logins on October 31 and November 2.

Some context

A member code is a number that identifies a customer in a store's reward program. Hackers often try to get into accounts so they can steal personal data or use points. Denny's Japan says it cannot yet tell whether a hacker or the customer themselves did some of the actions in the logs. That is why the full picture is still unclear.

Why it matters

Customers may have had some personal details exposed, such as their email and birthday. Even without passwords or card numbers, this data can be used for scam emails or fake messages. The story is also one of many recent data leaks at Japanese companies with apps, which shows how risky app switches can be.

What to watch

  • How many people were affected once the investigation finishes.
  • Whether the other time periods show more access by outsiders.
  • Notices sent to people whose data may have leaked.
  • Some users may need to log in again when they open the app.

Glossary

Denny's Japan
The company that runs the Denny's restaurant chain in Japan.
Denny's app
A phone app where customers manage coupons, points, and member information for Denny's.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

Securityheise online

Sabotage of Cooling Systems: Expert Criticizes Manufacturers

After cyberattacks on supermarket refrigeration systems in several European countries, including Germany, IT security expert Christoph Fischer of Karlsruhe places primary responsibility on manufacturers of networked devices, calling the delivery of control systems with unchanged factory settings and default passwords "completely unforgivable." He says manufacturers should configure systems so that individual passwords must be set at first commissioning, and that secure remote access via certificates and asymmetric encryption is technically feasible. Fischer also warned against limiting the problem to grocery retail and urged that verification of IT security be added as a criterion in consumer tests.

SecurityITmedia

Sega Faave Hit by Unauthorized Access, Arcade Services Suspended; Bandai Namco's Taiko no Tatsujin Also Affected

Sega Faave, a Sega Sammy Holdings subsidiary, said on November 2 that some of its servers were accessed by a third party without authorization, and it suspended related services from 3 p.m. on November 1. Arcade online services, ALL.Net, Aime, and new SEGA ID registrations are affected, and Bandai Namco Experience titles such as Taiko no Tatsujin and Mario Kart Arcade GP DX are also impacted. The company is investigating whether any information was leaked; its initial probe found no leak of customer or business partner data, and services will resume after the investigation and safety checks are complete.

Security전자신문

China-linked hackers launch AI-driven attacks on over 200 organizations worldwide, targeting US chip and defense firms

According to CrowdStrike's threat analysis report, the China-linked hacking group "VAPOR PANDA" carried out AI-based cyberattacks against at least 14 countries over 11 days starting on the 17th of last month. The attacks used the Chinese large language model DeepSeek and the AI-based intrusion tool "ARTEX," which was originally an open-source penetration testing tool that attackers have misused. Targets included US pharmaceutical, chip, defense, nuclear and financial firms, as well as telecom operators in the US, Belgium and the Philippines.

SecurityITmedia

Up to 77 Million Email Addresses Possibly Leaked in Arara Message Breach; Attackers Breached Client Company Servers

Paycloud Holdings said on November 2 that about 77 million email addresses may have been leaked or exposed in the unauthorized access to its subsidiary Arara's email delivery service "Arara Message," with up to about 380 contracted companies affected. Attackers reportedly entered contracted companies' systems via Arara Message servers between October 28 and 31, taking data from 97 servers, and were also found to have sent up to about 7.13 million phishing emails impersonating credit card companies. The service has been fully suspended since October 31, with no restart date set.