EXPLORINEER
en

JP — ITmedia

Matsuya App Restored After 9 Days, With Up to 3x Points as an Apology

Security1 min read

Matsuya, a Japanese beef bowl chain, has brought back its official app nine days after a hacking attack shut it down. To say sorry, it is giving extra points to users who order again.

The app is back online

Matsuya Foods Holdings said on November 6 that its official Matsuya app is working again. The app had been shut down since October 28 after hackers broke into it. Users need to update the app to use it again. Until November 30, the app's bento ordering service gives double points, and mobile ordering gives triple points.

Key facts

  • The app was down for 9 days.
  • Personal data of about 2.38 million records was leaked from the app's management system, according to the company's October 30 announcement.
  • Leaked data includes member IDs, names, and phone numbers.
  • Points: 2 times the normal amount for bento orders, 3 times for mobile orders, until November 30.
  • In November and December, users get a rank one level higher than their usual rank based on last month's spending.

What went wrong

On October 28, the company found unauthorized access to the app's management system. It stopped the official website, the app, and the bento ordering service. The company says the cause and the way the hackers got in are still being checked.

Why it matters

Millions of customers may have had their personal information taken. Users should watch for strange messages and be careful with their accounts. The story also shows how a single weak system can stop many services at once and leak customer data.

What to watch

  • Whether the company finds the cause and how the hackers got in.
  • Whether the app stays stable and new attacks are prevented.
  • Whether more details about the leaked data are announced.
  • Whether the points campaign and rank bonus are used by customers.

Glossary

Matsuya Foods Holdings
The company that runs the Matsuya beef bowl restaurant chain.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

SecurityITmedia

Lottery Official Site Suspended After User Passwords Were "Unintentionally Changed"; Scope Under Investigation

The official Takarakuji (lottery) X account said on November 5 that it had confirmed an issue in which users' passwords on the official lottery website were changed unintentionally, and that it had suspended use of the site. It is working quickly to identify the scope and will notify affected users once details are known. As of 10 a.m. on November 6, the site still showed a suspension notice with no restoration timeline, and the "continuous purchase campaign" could not be applied for.

SecurityThe Register

Feds warn grocers: Don't chill on cyber defenses as freezer hacking spree heats up

US federal agencies, including the FBI and CISA, urged owners and operators of industrial smart freezers to disconnect them from the internet, apply patches, and change default passwords. The warning follows hacks of thousands of refrigeration systems at hundreds of grocery stores in Europe since mid-October, which raised temperatures to 50ºC and spoiled food. The article notes no documented attacks on American supermarkets had been confirmed at the time of publication.

SecurityThe Register

Threat actor targets Indian fintechs on weekends when defenders aren’t watching

India's CERT-IN has warned of a "significant escalation" in attacks by an AI-assisted threat actor it calls CRAFTY FALCON, which targets fintechs and payment providers. The group re-targets victims, including after incomplete remediation, and times attacks to holidays and weekends to delay detection. CERT-IN urges better logging, real-time monitoring, keeping test environments off the internet, and 24x7 monitoring.

SecurityArs Technica

Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

A decade-old vulnerability affects devices running some configurations of Alpine Linux and possibly other distributions, allowing attackers to log in without a password. It arises from the interaction between OpenSSH and musl, and requires that OpenSSH not use PAM, that an account have a SHA256 or SHA512 hashed password, and that the account be set to passwordless with "*" in /etc/shadow. Alpine maintainers warned that an attacker who can reach the SSH port can log in in a single connection, every time.