{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Pizza Hut Japan: attackers accessed the online-ordering payment API, up to about 4.48M records exposed · updates",
  "home_page_url": "https://pwn.watch/i/pizza-hut-japan-payment-api-breach-oct-2026",
  "feed_url": "https://pwn.watch/i/pizza-hut-japan-payment-api-breach-oct-2026/feed.json",
  "description": "On Oct 19 2026 a third party gained unauthorized access to Pizza Hut Japan's online-ordering payment API and took customer data. The company confirmed customer IDs, email addresses, phone numbers, transaction records, deleted-customer records and session login tokens leaked; credit card data was not. Japanese media put the total at up to about 4.48 million records. Pizza Hut blocked the source, fixed the vulnerability and reported to Japan's Personal Information Protection Commission; the investigation continues.",
  "language": "en",
  "_pwn": {
    "slug": "pizza-hut-japan-payment-api-breach-oct-2026",
    "severity": "high",
    "status": "live",
    "patchStatus": "no-fix-needed",
    "rss": "https://pwn.watch/i/pizza-hut-japan-payment-api-breach-oct-2026/feed.xml",
    "llms": "https://pwn.watch/i/pizza-hut-japan-payment-api-breach-oct-2026/llms.txt",
    "json": "https://pwn.watch/i/pizza-hut-japan-payment-api-breach-oct-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/pizza-hut-japan-payment-api-breach-oct-2026#2026-10-23-ac80c9cb",
      "url": "https://pwn.watch/i/pizza-hut-japan-payment-api-breach-oct-2026#2026-10-23-ac80c9cb",
      "title": "Pizza Hut Japan: attackers accessed the online-ordering payment API, up to about 4.48M records exposed: Pizza Hut Japan discloses the breach: customer IDs, emails, phone numbers, transaction records, deleted-customer records and session login tokens leaked; card data not affected. Reports put it at up to ~4.48M records.",
      "content_text": "Pizza Hut Japan: attackers accessed the online-ordering payment API, up to about 4.48M records exposed: Pizza Hut Japan discloses the breach: customer IDs, emails, phone numbers, transaction records, deleted-customer records and session login tokens leaked; card data not affected. Reports put it at up to ~4.48M records.\n\nSource: https://corp.pizzahut.jp/info/5540",
      "date_published": "2026-10-23T00:00:00.000Z",
      "external_url": "https://corp.pizzahut.jp/info/5540",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/pizza-hut-japan-payment-api-breach-oct-2026#2026-10-19-815fb776",
      "url": "https://pwn.watch/i/pizza-hut-japan-payment-api-breach-oct-2026#2026-10-19-815fb776",
      "title": "Pizza Hut Japan: attackers accessed the online-ordering payment API, up to about 4.48M records exposed: An attacker accesses Pizza Hut Japan's online-ordering payment API and obtains customer data.",
      "content_text": "Pizza Hut Japan: attackers accessed the online-ordering payment API, up to about 4.48M records exposed: An attacker accesses Pizza Hut Japan's online-ordering payment API and obtains customer data.\n\nSource: https://corp.pizzahut.jp/info/5540",
      "date_published": "2026-10-19T00:00:00.000Z",
      "external_url": "https://corp.pizzahut.jp/info/5540",
      "tags": [
        "high"
      ]
    }
  ]
}