Matsuya App Breach Exposes 2.38 Million Customer Records

Matsuya Foods Holdings, the Tokyo-based operator of the Matsuya beef bowl chain, said on October 30 that roughly 2.38 million personal records were leaked from the management system of its official app. The disclosure follows the unauthorized access the company first announced on October 29.

What was exposed

Users of the app's bento reservation service "Matsuben Net", its mobile ordering feature and the "Matsuben Delivery" service account for 2,377,127 of the records. For them, member IDs, names, phone numbers and "Matsuya Point" information were leaked, along with delivery addresses.

A separate group of 2,000 official app registration records, which could be as many as 3,000, also had prefecture, date of birth, email address and encrypted password exposed. The company says it does not hold credit card information, so card data is not affected.

Response and outlook

The cause and the route of the intrusion are still under investigation. Matsuya is preparing a report to Japan's Personal Information Protection Commission and will contact affected users in sequence. App members are to receive compensation for the period in which the service was unavailable, with details to be announced separately.

The company has urged users to be alert to suspicious emails, text messages and phone calls, since names, phone numbers and addresses can be used in phishing and impersonation attempts.

The official app and website have been offline since the evening of October 28, which also disables mobile ordering and bento reservations. Matsuya has not given a restart date but says it is aiming for a quick recovery.