日本ピザハット announced that its online payment API had been subject to unauthorized access by a third party, resulting in some customer information being obtained. Media reports put the scale of the leak at up to approximately 4.48 million records, while the cause and scope of the impact remain under investigation.
On 23 October, 日本ピザハット announced that its API for exchanging payment information for the online ordering service had been subject to unauthorized access by a third party, resulting in some customer information being obtained from the database. The unauthorized access is believed to have occurred on 19 October.
The leaked information may include customer IDs, email addresses, telephone numbers, records relating to deleted information, session login tokens and transaction records. The company said that credit card information was not included.
According to reporting by a TV Asahi-affiliated outlet, the information that may have been leaked is reported to total up to approximately 4.48 million records. However, the company's announcement page does not state a figure, and reports differ as to whether names and addresses were leaked.
The company said it was investigating the cause and scope of the impact, and disclosed that it had blocked the attacking IP addresses and taken corrective measures to address the vulnerability. Warning that the incident could result in the leakage of personal data, it urged customers to be alert for suspicious contacts exploiting their contact information and provided an inquiry channel.