大阪ガス（FitDish）Data breach / unauthorized access incident
- Occurred on
- October 8, 2026
- Announced on
- November 2, 2026
- Severity
- CLimited data such as email addresses and identifiers.
- Scale
- 34,489 records
- Main impact
- The email addresses of FitDish users, numbering 3万4,489件, were leaked due to unauthorized access at the contractor, and those leaked addresses may have been used to send suspicious emails or SMS messages. Arara's impact has been reported as up to approximately 約7,700万件.
- Information involved
- Email address
- Cause / key point
- The system of the outsourced email-delivery provider Arara suffered unauthorized third-party access (initially explained as exploitation of a Web server vulnerability; later updated to state that issues in the system environment were also involved).About Exploitation of vulnerabilities
- Industry
- Food & dining
- Sources
- Last updated
- November 4, 2026
Where to go for this information
The steps themselves are on the protection guide. These links match the kinds of data in this incident, plus support contacts.
Ask AI about this incident
Opens an AI chat with this page's URL already in the prompt. Treat the answer as a starting point — always verify with the official sources listed above.
Is this incident worth paying attention to?
Written & reviewed
Reviewed byYutaro SasaoFounder & CEO, MediaLeap Inc.
CEO of MediaLeap Inc. Working on both sides of web advertising and web media since 2013; founded the company in May 2025.
Review scope: cross-checking against primary sources (official and government announcements), verifying claims stay within the facts, and checking source attribution。Last reviewed:
Written by:Leak Watch editorial team (AI-assisted drafts verified against sources by the editorial team) · Reviewer profile · Request a correction
Related incidents
Browse the database →Incidents sharing the same company, service, attack method or industry (grouped automatically from the disclosures).
Incidents related to "アドレス"
Incidents where the damage spread through the same service or system.
- SSSカプコン（CAPCOM ID）2026.10.22 announced・Affected 11,774,247 records
- B徳島県（脇町高校NewsPicks）2026.10.19 announced・Affected 14 people
- Bユミルリンク（メール配信システムCuenote FC・Cuenote BASE）2026.10.19 announced・Affected 51,628,280 records
- C大阪市総合生涯学習センター（メール）2026.09.08 announced・Affected 168 people
- B薬日本堂株式会社（委託先メールサービス）2026.03.02 announced・Affected Unknown
- B株式会社じほう2026.02.26 announced・Affected 890 records
Same attack method
- SSHelpfeel（Gyazo）2026.09.16 announced・Affected 23,620,000 records
- SSEストアー(ショップサーブ)2026.10.16 announced・Affected 23,356,000 people
- SSアソビュー2026.11.03 announced・Affected 15,821,184 records
- Cビックカメラ、コジマ、ソフマップ2023.11.02 announced・Affected 14,900,000 records
- SSSKDDI(ISP事業者向けメール基盤)2026.06.23 announced・Affected 12,231,954 people
- Sムラウチドットコム2026.09.15 announced・Affected 7,710,000 records
Same industry
- SSバーガーキング・ジャパン(公式アプリ)2026.10.15 announced・Affected 11,180,000 records
- SSライドオンエクスプレス（『銀のさら・釜寅・すし上等』公式サイト・公式アプリ）2026.10.13 announced・Affected 6,500,000 records
- SS焼肉きんぐ2026.10.05 announced・Affected 10,788,963 records
- SSニチレイグループ2026.09.18 announced・Affected Unknown
- Sアサヒグループホールディングス2026.07.17 announced・Affected 1,525,000 records
- S佐嘉平川屋2026.06.15 announced・Affected Unknown
Attack method classification: Exploitation of vulnerabilities(Breaking in through holes in software and devices)
Read the Exploitation of vulnerabilities guide and national trends →