Matsuya app breach leaks 2.38M customer records

What the Matsuya app breach leaked

About 2.38 million records leaked: 2,377,127 from Mobile Order and delivery users and 2,000 from app members, with no credit card data among them. Matsuya Foods Holdings, the Tokyo company behind the Matsuya beef bowl chain, posted a notice in Japanese on October 30, 2026. It said a third party had broken into the system that manages the official Matsuya app, and that the leak came to light on October 28.

Different data leaked for each of the two groups. Name, phone number, member ID and Matsuya points appear in both:

Data confirmed leaked, per Matsuya Foods' October 30 notice

Group	Data leaked	Records
Matsuben Net, Mobile Order and Matsuben Delivery users	Name, phone number, delivery address, member ID, Matsuya points	2,377,127
Registered Matsuya app members	Name, phone number, email address, date of birth, prefecture, member ID, Matsuya points, encrypted password	2,000 (possibly up to 3,000)

Several Japanese restaurant and retail apps reported leaks in October. Yakiniku King data breach hits 10.79M app members covers one from earlier in the month, and Japan data breach list: cases by date and cause tracks the rest.

Mobile Order users' addresses and phone numbers leaked

People who used Matsuben Net, Mobile Order or Matsuben Delivery had their member ID, delivery address, name, phone number and Matsuya points leaked. These three services account for 2,377,127 of the roughly 2.38 million records:

• Matsuben Net: reserve a bento box ahead of time
• Matsuben Delivery: home delivery
• Mobile Order: order ahead from a smartphone

Matsuya Foods describes these as confirmed leaks, not possible ones. Because a phone number and a delivery address sit next to each name, this group should expect scam calls and text messages, not just fake emails.

2,000 app members had encrypted passwords exposed

More types of data leaked for the smaller app member group, including date of birth, email address and an encrypted password. Matsuya Foods counts 2,000 records here and says the figure could rise to 3,000.

Encryption makes a stolen password harder to use, but it does not make the password safe to keep using. Anyone who used the same email and password on another site should change that password there. Matsuya Foods says it does not store credit card numbers at all.

What Matsuya Foods has and has not said

Matsuya Foods is reporting the leak to Japan's privacy regulator and plans to contact affected customers one by one. The regulator is the Personal Information Protection Commission, the government body that oversees how companies in Japan handle personal data. The notice lists four next steps:

• Working with related companies to bring the system back as soon as possible
• Taking the required steps, including the report to the commission
• Contacting each customer whose data leaked, in turn
• Compensating app members for the time the service is unavailable, with details to come in a separate notice

Since Matsuya Foods will reach out to affected people itself, real messages and fake ones may land in the same week. A message that asks for a password or card number is fake either way.

The app is down and members will be compensated

Matsuya Foods has not given a restart date, and in the meantime its official X accounts post coupons that work at store ticket machines. The official app and website remain offline, and the company says it aims to restore them quickly. (Update, November 6, 2026: Matsuya Foods announced that the official app has been restored; users must log in again. The Matsubento online ordering site and the corporate homepage were still being restored that day, per Impress Watch.)

On October 29, the Matsuya and Matsunoya accounts on X began posting coupon images. They stand in for the usual app coupons: customers scan the QR code at the ticket machine inside the store. What app members will receive as compensation has not been announced yet.

The cause has not been made public

Matsuya Foods has confirmed only that a third party got in, and its October 30 notice does not say how. The company says it is still looking into the cause and how the access became possible. Which part of the management system was targeted, and how member records were taken, were not known at the time of the notice.

The app member count is also not final, since the notice gives 2,000 records with a possible rise to 3,000. Figures and scope may change in later notices.

How to tell real Matsuya messages from fake ones

Matsuya Foods warns that the leaked data may be used to impersonate the company by email, SMS or phone. Impersonation here means someone contacts you while pretending to be Matsuya, usually to steer you to a fake site or get a password or card number out of you.

Both groups had phone numbers leaked, and the larger group's delivery addresses leaked too. Scammers can now open a text or call with your real name, which makes a fake message look more convincing than a generic one.

Matsuya will not ask for passwords or card details

Any email or call that asks for a password or card number in Matsuya's name is not from Matsuya. The company says in its notice that it will never request either one by email or phone.

Expect lures built around this incident, such as a message about claiming compensation or about logging back in when the app returns. Since the app and website are offline, a link that leads to a "Matsuya login page" is a warning sign in itself.

Matsuya Foods' personal information inquiry desk

The desk takes calls at 0422-38-1121 on weekdays from 10:00 to 16:00 and also has an email address. Matsuya Foods set it up for questions about this leak, and it operates in Japanese.

• Name: Matsuya Foods Holdings personal information inquiry desk
• Phone: 0422-38-1121 (press 1 after the recorded message)
• Email: contact_information@matsuyafoods.net
• Hours: weekdays 10:00 to 16:00 Japan time, closed on weekends and public holidays

Use the number and address listed here or in Matsuya Foods' own notice, not ones that appear in a message you received. To email the desk, type the address yourself rather than replying to a message.

What companies and individuals should check now

Japanese regulators ask companies to control and watch admin access and ask individuals to prepare for scam calls and texts. The attackers in this case went after the system that stores member records, not the app on people's phones. One successful break-in at that layer exposed about 2.38 million records at once.

In October, two Japanese agencies published guidance that fits this case. The Personal Information Protection Commission wrote to businesses, and the Consumer Affairs Agency, which handles consumer protection, wrote to the public.

Companies: control, authenticate and monitor admin access

On October 7, the Personal Information Protection Commission told businesses to limit access to personal data, authenticate every user and set up early detection of break-ins. The alert followed a run of large leaks caused by outside attacks, and it previewed revised technical safeguards that are due to be finalized in April 2027.

Nothing in Matsuya Foods' notice shows that it skipped any of these measures. Still, any company that keeps member data in an admin system can check the same three points.

Limit who can reach member data

Access control, which limits the staff and systems that handle personal data, is one of the safeguards the commission lists for businesses. Fewer admin accounts, each able to see only what it needs, mean that a single stolen account exposes less.

Identify and authenticate every admin login

Another safeguard is to identify each person who uses a system holding personal data and confirm that they have the right to access it. With a separate account for every staff member, a company can tell later who logged in and when, which a shared account cannot show.

Detect unauthorized access early

The third point is to have detection in place before anything happens, so that unauthorized access is caught early and damage does not spread inside the network. Alerts on logins at unusual hours or on bulk data exports give a company the chance to shut a system down before more records leave.

Individuals: prepare for scam calls and texts

Both groups had phone numbers leaked, so the Consumer Affairs Agency's advice on SMS links and scam calls applies directly. Its October 29 alert covers what to do after a company leaks your data.

Open Matsuya from a bookmark, not a link

Going to a bookmarked site or the official app, instead of tapping a link in a text or email, keeps you off fake sites. Any SMS or email from a business or public body can be phishing, meaning a message that pretends to come from a real company to steal IDs, passwords or card numbers. With Matsuya's app and website offline, a message announcing the restart deserves the same caution.

Block scam calls with a police-recommended app

An app that screens known scam numbers lets you skip calls before you answer, which matters when your number, name and address are already out. The agency recommends installing one of the anti-fraud apps recommended by Japan's National Police Agency, some of which block scam calls automatically.

A caller who knows your name and address has not proven anything by it. For Mobile Order and delivery users, that information is exactly what leaked.

Change passwords you reused from the Matsuya app

Only the 2,000 app members had encrypted passwords leaked, and the Consumer Affairs Agency advises a strong new password that is not reused. If you used the same email and password for Matsuya and for another service, change the password on that other service first.

A strong password mixes upper and lower case letters, numbers and symbols. The agency also suggests checking card statements regularly, and its consumer hotline is 188 (Japanese only). SOKUFU's password generator creates one in your browser without sending it anywhere.