吉野家ホールディングス announced that a database operated by ApplyNow, which had previously handled part of its recruitment operations, was subject to unauthorised access by a third party, resulting in the leakage of 5,366 applicant records and 418 records relating to recruitment employees. The data remained after the contract ended, and the cause was unauthorised access exploiting a vulnerability in a data-analysis tool.
吉野家ホールディングス and its subsidiaries explained that a database operated by ApplyNow, which had handled part of their recruitment operations, was subject to unauthorised access by a third party, resulting in the leakage of personal information relating to 5,366 applicants and information relating to 418 group employees involved in recruitment. The affected data included applications submitted through Interview Cloud and ApplyNow.
The leaked information included names, email addresses, telephone numbers, dates of birth, gender, and in some cases addresses and occupations. It also included recruitment staff information such as usernames, email addresses, encrypted passwords and access privileges. No secondary damage had been identified as of 30 September, while the vulnerability that caused the incident had been remediated and data-preservation measures taken.
The cause was unauthorised access exploiting a vulnerability in ApplyNow’s data-analysis tool. The incident occurred from 9 August to 7 September 2026, and the unauthorised export of some data from the database was confirmed on 7 September. ApplyNow blocked access and completed remediation of the vulnerability that same day. Although the outsourcing contract had already ended, the data remained, and the discrepancy in understanding was discovered on 28 September. Notifications were sent to affected individuals from 1 October onward, and no action was required from them. 吉野家 HD plans to review its management framework and contract terms for outsourcing providers and strengthen regular audits.