Matsuya Foods Confirms Breach of 2.38 Million App Records

Matsuya Foods Holdings announced on the 30th that a third party gained unauthorized access to the management system of its official Matsuya app, leaking personal information on roughly 2.38 million records.

The company confirmed the intrusion on the 28th. The confirmed leak, totaling 2,377,127 records, covers users of Matsuya's online ordering, mobile order and delivery services. It includes member IDs, delivery addresses, names, phone numbers and Matsuya Points. Matsuya says it does not hold credit card data.

For about 2,000 users (up to 3,000), the exposed data also includes dates of birth, email addresses and encrypted passwords registered in the app.

Cause still under investigation

The cause and route of the intrusion are still being investigated. Matsuya says it is reporting to Japan's Personal Information Protection Commission and will contact affected users in turn. It warns that the data could be abused for impersonation, and stresses that it never asks for passwords or card details by email or phone.

App suspended, compensation offered

The app is currently out of service, so users cannot order, use points or redeem perks, and member ranks and the app version of MATSUYA PASS are unavailable. The company apologized and outlined measures.

For November and December, app members will be set one rank above the rank their previous month's spending would give them; a member projected as Silver in November would be treated as Gold. Those projected above Diamond will receive a separate meal benefit. People who bought the app MATSUYA PASS between September 26 and October 28 will receive, by email by November 1, a dedicated QR code that lets them use the pass discount at ticket vending machines during the outage.

Matsuya has also issued discount coupons usable at vending machines, including 30 yen off six beef bowl types, 50 yen off selected bowls and curries, and 70 yen off six standard set meals. Some stores are excluded.