Pizza Hut Japan: attackers accessed the online-ordering payment API, up to about 4.48M records exposed
Pizza Hut Japan online ordering (payment API)
On Oct 19 2026 a third party gained unauthorized access to Pizza Hut Japan's online-ordering payment API and took customer data. The company confirmed customer IDs, email addresses, phone numbers, transaction records, deleted-customer records and session login tokens leaked; credit card data was not. Japanese media put the total at up to about 4.48 million records. Pizza Hut blocked the source, fixed the vulnerability and reported to Japan's Personal Information Protection Commission; the investigation continues.
Why this severity: Up to ~4.48M records; session login tokens exposed; no card data
- Started
- Oct 19, 2026
Affected
- Pizza Hut Japan online-ordering customers (up to ~4.48M records)
Fixed in
No fixed release yet
Timeline2
Pizza Hut Japan discloses the breach: customer IDs, emails, phone numbers, transaction records, deleted-customer records and session login tokens leaked; card data not affected. Reports put it at up to ~4.48M records.
An attacker accesses Pizza Hut Japan's online-ordering payment API and obtains customer data.
Advisories1
News & write-ups2
Notes & caveats
The ~4.48M figure comes from Japanese media reports; check the company notice for the confirmed count. Leaked session tokens could allow account access if not invalidated.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
