Short answer
Matsuya Foods Holdings said on 29 and 30 October 2026 that a third party had accessed the management system behind its official app and that about 2.38 million personal records leaked. The app and website have been suspended since the night of 28 October, and the company said it does not hold credit card information.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Matsuya Foods Holdings |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Restaurants and food delivery |
| Country | Japan |
| Detected | 2026-10-28 |
| Disclosed | 2026-10-29 |
| People or records affected | 2,377,127 bento, mobile order and delivery records, plus about 2,000 (possibly up to 3,000) app member records |
What data was exposed
- Member ID, name, phone number and Matsuya Points information for 2,377,127 bento reservation, mobile order and delivery users
- Delivery addresses for those users
- Prefecture, date of birth, email address and encrypted password for about 2,000 app members (possibly up to 3,000)
What happened
Matsuya Foods Holdings announced unauthorized access on 29 October 2026 and updated the figures on 30 October. According to ScanNetSecurity, a third party gained access on 28 October to the management system for the Matsuya official app. ITmedia reports that the official app and website have been suspended since that night.
The two data sets
ITmedia and ScanNetSecurity give the same split. The first set covers users of the bento reservation (the “Matsuben Net” function), mobile order and delivery services: 2,377,127 records with member ID, name, phone number and Matsuya Points information. Delivery addresses were also exposed.
The second set is the app’s own member registrations: about 2,000 records, possibly up to 3,000, with member ID, prefecture, name, phone number, date of birth, email address, an encrypted password and points. The company said it does not hold credit card information.
What the company has done
Matsuya is reporting the incident to the Personal Information Protection Commission and will notify affected users in sequence. With the app suspended, ordering, points and benefits are unavailable, and the company said it is working with partners to restore the system quickly. App members will receive compensation for the suspension period, with details to follow.
What is not known
The cause and method of intrusion were still under investigation in the sources we read. We found no public claim from an attacker. The notice does not say whether any data was taken beyond the items above. Because the date for reopening has not been given, check the company’s official site for updates rather than relying on messages.
What scammers can do with it
A name, phone number and delivery address linked to a real food order make a fake delivery notice or a “compensation” message look genuine. The company asks users to be wary of suspicious emails, SMS and calls. Do not enter card details to claim compensation, since a genuine suspension payment would not need them.
See our guide to phishing messages and toll and delivery text scams for how these messages look, and the data breach checklist for first steps. Other Japanese incidents are on the breaches index, including Lawson.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake Matsuya messages about points, compensation or a login problem that link to a lookalike site.
- Delivery-themed texts using your real address and phone number.
- Calls that quote your name and address and ask for card details or SMS codes.
- Credential stuffing against other sites if you reused your Matsuya app password.
What to do if you are affected
- 01Do not tap links in messages about this incident. Wait for the company's official notice and use only its official site or app.
- 02Be wary of suspicious emails, SMS and calls, as the company advises.
- 03If you registered in the official app with a password you use elsewhere, change it on those other services.
- 04Watch for any announcement on compensation, and do not give payment details to claim it.
Frequently asked questions
How many records were leaked?
According to ITmedia and ScanNetSecurity, 2,377,127 records for users of the bento reservation, mobile order and delivery functions, and about 2,000 (possibly up to 3,000) app member records.
Were credit card numbers leaked?
The company said it does not hold credit card information, per ITmedia.
Is the Matsuya app working?
The official app and website have been suspended since the night of 28 October. Orders, points and benefits are unavailable, and the company has said it aims for an early recovery without a date.
Will I be compensated?
The company said app members will receive compensation for the suspension period, with details to be announced separately.
Sources
- 松屋アプリ不正アクセス、約238万件の個人情報が流出 (Matsuya app unauthorized access leaks about 2.38 million records), ITmedia NEWS, 2026-10-30
- 松屋公式アプリ不正アクセス、会員情報が流出 (Matsuya official app unauthorized access, member information leaked), ScanNetSecurity, 2026-11-04
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.