# Pizza Hut Japan: attackers accessed the online-ordering payment API, up to about 4.48M records exposed · pwn.watch

> On Oct 19 2026 a third party gained unauthorized access to Pizza Hut Japan's online-ordering payment API and took customer data. The company confirmed customer IDs, email addresses, phone numbers, transaction records, deleted-customer records and session login tokens leaked; credit card data was not. Japanese media put the total at up to about 4.48 million records. Pizza Hut blocked the source, fixed the vulnerability and reported to Japan's Personal Information Protection Commission; the investigation continues.

Page: https://pwn.watch/i/pizza-hut-japan-payment-api-breach-oct-2026 · generated 2026-10-24T08:44:16.553Z

## Status
- Severity: high · status: live · patch: no-fix-needed
- Product: Pizza Hut Japan online ordering (payment API)
- Started: 2026-10-19
- Affected: Pizza Hut Japan online-ordering customers (up to ~4.48M records)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/pizza-hut-japan-payment-api-breach-oct-2026/feed.xml
- JSON Feed: https://pwn.watch/i/pizza-hut-japan-payment-api-breach-oct-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/pizza-hut-japan-payment-api-breach-oct-2026.json
- This file: https://pwn.watch/i/pizza-hut-japan-payment-api-breach-oct-2026/llms.txt

## Updates (newest first)
- 2026-10-23: Pizza Hut Japan discloses the breach: customer IDs, emails, phone numbers, transaction records, deleted-customer records and session login tokens leaked; card data not affected. Reports put it at up to ~4.48M records. (https://corp.pizzahut.jp/info/5540)
- 2026-10-19: An attacker accesses Pizza Hut Japan's online-ordering payment API and obtains customer data. (https://corp.pizzahut.jp/info/5540)

## Fix brief
# Security brief: Pizza Hut Japan: attackers accessed the online-ordering payment API, up to about 4.48M records exposed

Source: https://pwn.watch/i/pizza-hut-japan-payment-api-breach-oct-2026 · status: live · severity: high · updated Oct 24, 2026, 06:40 UTC

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
On Oct 19 2026 a third party gained unauthorized access to Pizza Hut Japan's online-ordering payment API and took customer data. The company confirmed customer IDs, email addresses, phone numbers, transaction records, deleted-customer records and session login tokens leaked; credit card data was not. Japanese media put the total at up to about 4.48 million records. Pizza Hut blocked the source, fixed the vulnerability and reported to Japan's Personal Information Protection Commission; the investigation continues.

Severity detail: Up to ~4.48M records; session login tokens exposed; no card data

- Product: Pizza Hut Japan online ordering (payment API)

## Affected versions
- Pizza Hut Japan online-ordering customers (up to ~4.48M records)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Oct 23, 2026: Pizza Hut Japan discloses the breach: customer IDs, emails, phone numbers, transaction records, deleted-customer records and session login tokens leaked; card data not affected. Reports put it at up to ~4.48M records.
- Oct 19, 2026: An attacker accesses Pizza Hut Japan's online-ordering payment API and obtains customer data.

## Advisories
- [個人データ漏えいにつながる不正アクセスに関するお詫びとお知らせ](https://corp.pizzahut.jp/info/5540) (Pizza Hut Japan)

## Write-ups & news
- [ピザハット、電話番号など顧客情報漏洩　不正アクセスで](https://www.nikkei.com/article/DGXZQOUC23BAT0T21C26A0000000/)
- [ピザハットで客らの情報約448万件流出か　オンライン注文サービスに不正アクセス](https://news.yahoo.co.jp/articles/5c1a01b35837ec549e919bdfab6285c95d21eb73)

## Caveats
The ~4.48M figure comes from Japanese media reports; check the company notice for the confirmed count. Leaked session tokens could allow account access if not invalidated.

---
Machine-readable: https://pwn.watch/i/pizza-hut-japan-payment-api-breach-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.