JP — ITmedia

Matsuya App Hit by Unauthorized Access, About 2.38 Million Personal Records Leaked; Compensation Planned During Suspension

SecurityOctober 30, 20262 min read

Matsuya, a Japanese beef bowl chain, says hackers broke into its app management system and stole personal data from about 2.38 million records. The company has paused its app and website and plans to pay compensation to app members.

What happened

Matsuya Foods Holdings, which runs the Matsuya restaurant chain, announced on October 30, 2026 that someone had gained unauthorized access to its official app. The attack was first reported on October 29. Personal data was leaked from the app's management system. The company is still looking into how the attackers got in. Since the night of October 28, the app and website have been shut down. The company has not said when they will reopen.

Key numbers and facts

About 2,377,127 records were leaked from users of the meal-reservation service, mobile ordering, and home delivery service. Delivery addresses were also stolen.
About 2,000 app member records were leaked, and the number could be as high as 3,000. These include prefecture, date of birth, email address, and encrypted passwords.
Leaked items include member IDs, names, phone numbers, and Matsuya Point information.
Matsuya says it does not store credit card information.

Some simple background

Matsuya's app lets customers order food on their phones, book bento lunch boxes, and get points. When a company's computer system is hacked, criminals can take private information such as names, phone numbers, and addresses. Criminals may later use this information to send fake emails, text messages, or calls that try to trick people.

Why it matters

This leak affects a very large number of people. Customers may worry about their private information and about scams. The app and website being shut down also means people cannot order food or use their points. Matsuya plans to pay compensation to app members for the time the service was stopped, which shows how much the company's customers are affected.

What to watch

How and when the attackers got in, which the company is still investigating.
When the app and website will reopen.
Details of the compensation for app members, which the company will announce later.
Notices to affected customers, which the company says it will send one by one.
Reports to the Personal Information Protection Commission, Japan's privacy watchdog.

Glossary

Matsuya Foods Holdings: The company that runs the Matsuya beef bowl restaurant chain.
Matsuya Point: Matsuya's reward points program for customers.
Personal Information Protection Commission: Japan's government group that watches over how companies protect people's private information.

Iris Ohyama's online store hit by unauthorized access; information leak under investigation

Iris Ohyama announced on October 29 that its official online store "Iris Plaza" suffered unauthorized access and has been temporarily suspended. The company is still investigating whether any information was leaked. As of the current investigation, no leak of credit card information has been confirmed, and other information is still being examined.

SecurityITmediaOct 30

Yakult Honsha Confirms Leak of About 40,000 Personal Records After Unauthorized Access to Official Website

Yakult Honsha announced on October 30 that its website was accessed by a third party without authorization, leading to the leak of personal information for about 40,000 people, including users of its inquiry forms. Leaked data includes names, contact details and inquiry content, as well as member information for its "Tanoshii Kyushoku" program, while the company says it does not hold customer credit card or bank account details. The website was taken offline on October 26 and remained under maintenance as of October 30, and the company has reported the incident to the Personal Information Protection Commission and consulted police.

SecurityVnExpressOct 30

Trucks carrying AI data center equipment become thieves' targets

Thieves have hijacked logistics companies' accounts and posted fake loads to take over real shipments of AI data center equipment in the US. According to NBC News, goods worth more than $100 million have been stolen since June, including Bitcoin mining devices, servers, copper wire and memory chips. Logistics firms are responding by adopting new software to verify driver licenses and using generative AI to track cargo.

SecurityThe RegisterOct 30

Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers

Dream researchers say suspected Chinese attackers chained PHP2Shell with the Linux kernel flaw Fragnesia (CVE-2026-46300) to gain root on 25 servers, including Palo Alto Networks firewalls linked to US government-affiliated organizations. The attacks began October 23 and targeted organizations in the US, Japan, Taiwan, and South Korea. Dream believes the attackers likely still have persistent remote access to compromised networks.