Yakiniku King data breach hits 10.79M app members

Yakiniku King data breach found on October 2

The Yakiniku King data breach came from a third party breaking into the member management system behind the chain's official app. Yakiniku King is a Japanese barbecue chain run by Monogatari Corporation. The company posted an apology and a timeline on its Japanese website on October 5.

From detection to disclosure (per Monogatari Corporation)

Date	What happened
Fri, Oct 2	Unauthorized access to the member system found; connection cut and defenses put in place
Sat, Oct 3	Leak of member information confirmed
Mon, Oct 5	Apology and details published

As of the announcement, the company had no evidence that the data had been posted publicly or misused. On the same day, GMO Research & AI disclosed a separate break-in at its survey site; that case is covered in infoQ data breach exposes up to 948,498 records.

Personal data exposed in the Yakiniku King data leak

Out of 10,808,784 registrations, 10,788,963 leaked, roughly 99.8%. In practice, anyone with a Yakiniku King app account should assume their details are in the leaked set.

Four pieces of personal data were taken: the member number, the name, the email address and the phone number. The name is whatever the user typed into the app, so it may be a nickname rather than a legal name. Still, a name paired with a working email address and phone number is enough to write a message that looks personal.

No passwords or credit card information in the data leak

The rest of the account data stayed put, according to the company. This table splits what leaked from what did not:

Monogatari Corporation does not store card numbers at all, so payment details were never part of this breach. Login passwords sat outside the leaked set as well.

Yakiniku King security breach cause is under investigation

The company has not said how the attacker got in. Its notice confirms only that the leak came from unauthorized access by a third party and that a detailed investigation is under way. No method, weak point or system name has been made public.

The app is still running, with defenses added after the break-in. Monogatari Corporation says it is tightening security and monitoring with help from its app developer and affiliated companies.

The company is reporting the case to the Personal Information Protection Commission, Japan's privacy regulator, and filing a damage report with the police. It applied the same defenses to the apps for its other restaurant brands and says no data leaked from those apps.

Watch for phishing email and smishing after the data leak

The main risk for members now is fake messages that use their real name and contact details. Monogatari Corporation warns that the leaked data could be used for impersonation email and phishing, where a scammer poses as a real company to steal logins or card numbers. The same trick sent by text message is called smishing.

The company asks members to be wary of suspicious email, text messages and phone calls, and not to open links or attachments they don't recognize. An apology coupon or an "account check" is an easy hook, so open the app or the official website yourself rather than tapping a link in a message.

Monogatari Corporation also says it will never ask for a password or credit card details. Any message that does is not from the company.

Members with questions can call the app's call center at 0120-795-775, a toll-free number inside Japan, from 10:00 to 18:00, weekends and holidays included. For now, the practical response to the Yakiniku King data breach is simple: treat every message that claims to be from the chain with suspicion.