Short answer
Ride On Express Holdings said on 13 October 2026 that the server company hosting registration data for Ginno Sara, Kamatora and Sushi Jotatsu was hit by ransomware. Up to about 6.5 million records may have leaked, and online ordering is still suspended.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Ride On Express Holdings (Ginno Sara, Kamatora, Sushi Jotatsu) |
|---|---|
| Incident type | Ransomware |
| Status | Confirmed by the organization |
| Sector | Food delivery |
| Country | Japan |
| Detected | 2026-10-05 |
| Disclosed | 2026-10-13 |
| People or records affected | Up to about 6.5 million registrant records, a maximum and not a confirmed count |
What data was exposed
- Name, address, phone number and email address
- Gender and date of birth
- Password hashes (not readable as plain text)
- Order history and member IDs
- Family names and birthdays, and delivery recipient details, if the customer entered them
What happened
Ride On Express Holdings runs the Ginno Sara, Kamatora and Sushi Jotatsu delivery sushi brands. On 13 October 2026 it published its third update on a cyberattack on the server that stores customer accounts for the brands’ websites and apps.
The company’s timeline starts on 5 October, when it detected unauthorized third-party access to servers. In the early morning of 7 October some servers failed. The server operator then reported a ransomware attack and said the data entrusted to it could not be easily retrieved or restored. The company shut its systems down that day and set up an emergency team. On 13 October it decided to tell customers who might be affected.
Who is in the data
Past registrants of the official sites or apps are covered. Customers who ordered only through Demae-kan, Uber Eats or by phone are not. The company says the figure of about 6.5 million is a ceiling. It has not found clear evidence that data left the server, and it has not set the final scope.
Password hashes are on the list. A hash is a scrambled form of a password. It is harder to use than plain text, but weak passwords can still be cracked, so reused passwords are worth changing.
Impact on ordering
Phone orders, in-store takeout, Demae-kan and Uber Eats continue. Orders on the official website and apps are off, and no restart date has been announced. INTERNET Watch added that a ransomware attack on the cloud firm IDCF Cloud on 7 October affected 495 contracted companies and municipalities, though it did not say the two events are linked.
What the company says it has done
The company told the Personal Information Protection Commission and the local police. It says it has not confirmed any secondary harm and advises customers to be wary of suspicious calls and emails.
Watch for fake apologies
A single mailed notice is easy to copy. Anyone who gets an “apology” email with a link should go to the brand’s site by typing the address. Our guides on phishing messages, online shopping scams and urgent payment scams cover how these look. The data breach checklist has the full steps.
What is still unknown
The hosting provider is unnamed, and no one has claimed the attack publicly in the sources we read. Follow our breaches index and the editorial policy for how updates are labelled.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake apology emails posing as Ginno Sara, with links to a login page.
- Calls using your order history and address to claim a refund or a delivery problem.
- SMS about a 'points' or 'coupon' compensation that asks for card details.
- Password reuse attacks if you used the same password on other sites.
What to do if you are affected
- 01Do not click links in any email about this incident. The company asks customers to delete suspicious emails, especially ones asking for passwords.
- 02If you used the same password on the Ginno Sara app or site elsewhere, change it on those other services.
- 03Order by phone, in store, Demae-kan or Uber Eats while the official site and app are down.
- 04For questions, call the company's line on 0120-782-272 (10:00 to 20:00 daily until 15 November, then weekdays).
- 05Report suspicious calls to #9110 and consumer problems to 188.
Frequently asked questions
Is my credit card at risk from the Ginno Sara leak?
The company says it does not hold credit card data, so card numbers are not part of the affected records.
Can I still order Ginno Sara?
By phone, in-store takeout, Demae-kan and Uber Eats, yes. Orders on the official website and app are suspended, with no restart date given.
Was the company hacked directly?
The company says the server operator it uses reported a ransomware attack, and that data entrusted to that operator could not be easily retrieved or restored. INTERNET Watch noted the operator has not been named.
Are Demae-kan or Uber Eats orders affected?
According to the company, customers who only ordered via Demae-kan, Uber Eats or phone are not in the affected set.
Is the 6.5 million figure confirmed?
No. It is the maximum the company says could be affected. It had not found clear evidence of a leak or fixed the scope when it posted the notice.
Sources
- Notice on a cyberattack on the server holding registration data, third report (Ride On Express Holdings, Japanese), Ride On Express Holdings, 2026-10-13
- ライドオンエクスプレス「銀のさら」「釜寅」「すし上等」 最大約650万件の個人情報が漏えいした可能性 (Ride On Express: up to about 6.5 million personal records may have leaked), INTERNET Watch, 2026-10-13
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.