JP — ITmedia

Matsuya suspends official app and website after detecting unauthorized access; mobile ordering and bento reservations also unavailable

SecurityOctober 29, 20261 min read

Matsuya, a large Japanese beef bowl chain, has shut down its official app and website after detecting unauthorized access from outside. Its mobile ordering, bento reservation, and delivery services are not working.

What happened

Matsuya Foods, which runs the Matsuya chain, and its parent company Matsuya Foods Holdings said on October 29 that they had found unauthorized access from outside. To stay safe, they stopped the Matsuya app, the official website, and related services. Customers cannot use bento reservations, mobile ordering, or the Matsuya bento delivery service.

Key facts

The problems began around 7:00 p.m. on October 28, when people on X said they could not order in the Matsuya app.
Some customers bought meal tickets outside the store instead. Others said their payments failed because of connection errors.
By about 10:00 p.m., people also reported that the website would not load.
At 10:41 p.m., Matsuya posted on its official X account that it had stopped the website, app, and bento reservation service for emergency maintenance.

Background

Unauthorized access means someone breaks into a computer system without permission. Companies often shut down services while they look for the cause and check whether customer data is safe. Matsuya has not yet said how the access happened or how far it spread.

Why it matters

Many customers use apps to order food and pay. When these systems stop, people cannot buy meals the usual way, and the company may face questions about customer safety. Other companies can also learn from this case about how important security is.

What to watch

Matsuya has said it will share more news about the cause, the damage, and when services will return.
Watch whether the company reports any leak of customer information.
Check whether the app, website, and bento services come back online.

Signs Suggest Hackers Took Over 25 Servers by Exploiting PHP Flaw; South Korea Also Targeted

Researchers at Dream Research, the security unit of Israeli cybersecurity firm Dream, reported signs that attackers exploiting a recently discovered PHP vulnerability took over 25 servers, including a U.S. government-related system. Of about 240 firewalls in South Korea, the U.S., Japan, and Taiwan that were targeted, 24 had root access obtained, and the investigation found no confirmed evidence of a China-linked group or AI-written attack code.

SecurityITmediaOct 29

Users Report Losing All Funds From Bank Linked to PayPay; PayPay Explains Causes and Countermeasures

A post on X drew attention in late October after a user reported that money was charged from a bank account linked to PayPay into their balance and then sent out without their knowledge. PayPay told ITmedia that unauthorized transfers from devices suspected of malware infection have been increasing since around August, and it is strengthening monitoring and countermeasures. The company advises users to avoid installing apps from outside official stores, to deny permissions that allow remote control of their phone, and to set spending limits.

SecurityITmediaOct 29

METI's "Dentrinet" Suspended After Unauthorized Access; Site for Electricity and Gas Operators' Periodic Reports

The Ministry of Economy, Trade and Industry's Electricity and Gas Market Surveillance Commission announced on October 28 that Dentrinet, the website where retail electricity and gas businesses periodically submit reports, was accessed without authorization and its system was shut down. Whether any information was leaked is still being checked, and reports are being accepted by email until the system is restored. The commission confirmed the unauthorized access on October 28 after it occurred in the early hours of October 27, and is investigating the cause and considering measures to prevent a recurrence.

SecurityThe VergeOct 29

A hacker stole more than 40,000 DHS employee records

A hacker stole personal information on more than 41,000 Department of Homeland Security employees, including staff at ICE and CBP, according to TechCrunch and Wired. The exposed data includes names, job titles, phone numbers, email addresses, and office locations, and it also links the agencies to specific surveillance tools. The hacker, known as "Department of Peace," reportedly accessed the data through Okta, an identity and access management service used by the DHS.