Denny's Japan App Hit by Unauthorized Access, Data May Leak

What may have been exposed

The data that may have leaked belongs to some users of the old app: membership code, email address, date of birth, gender, prefecture of residence, favorite store and kids' birthday information.

The findings confirmed so far cover only access records from October 7. Other periods are still being examined, so the full scope and the number of people potentially affected have not been determined.

Timeline and response

While investigating suspicious access on October 30, the company confirmed that credentials tied to the old app had been forged. The same day it modified the system to stop new forged credentials from being created. On October 31 it invalidated the illegitimate credentials, and on November 2 it disabled additional ones found in further checks.

The company found logs showing that the process for retrieving personal data was executed. However, it cannot yet distinguish between operations by a third party and those by customers themselves, so whether data was actually obtained, what it contained and how many people were affected remain under investigation.

Because of the countermeasures, some users may see the initial screen when launching the app and need to log in again.

Denny's Japan is working with an internal specialist department and its system development partner to determine the cause and scope. Users who may have been affected will be contacted individually once they are identified.