日本ピザハット株式会社（ピザハット）Data breach / unauthorized access incident
- Occurred on
- October 19, 2026
- Announced on
- October 23, 2026
- Severity
- SCompromise of deep personal data or usable credentials.
- Scale
- Unknown
- Main impact
- A third party gained unauthorized access to the payment API for ピザハット's domestic online ordering service, and customer email addresses, phone numbers, customer IDs, session tokens, and transaction records were exfiltrated. Credit card information is said to be not included, but the leakage of authentication tokens creates a risk of account misuse.
- Information involved
- Email addressUser / member IDAuth tokenPhone number
- Cause / key point
- Unauthorized access to the payment API by a third party led to partial data being retrieved from the database, constituting an access breach.
- Industry
- Food & dining
- Sources
- Last updated
- November 5, 2026
Where to go for this information
The steps themselves are on the protection guide. These links match the kinds of data in this incident, plus support contacts.
Ask AI about this incident
Opens an AI chat with this page's URL already in the prompt. Treat the answer as a starting point — always verify with the official sources listed above.
Is this incident worth paying attention to?
Written & reviewed
Reviewed byYutaro SasaoFounder & CEO, MediaLeap Inc.
CEO of MediaLeap Inc. Working on both sides of web advertising and web media since 2013; founded the company in May 2025.
Review scope: cross-checking against primary sources (official and government announcements), verifying claims stay within the facts, and checking source attribution。Last reviewed:
Written by:Leak Watch editorial team (AI-assisted drafts verified against sources by the editorial team) · Reviewer profile · Request a correction
Related incidents
Browse the database →Incidents sharing the same company, service, attack method or industry (grouped automatically from the disclosures).
Incidents related to "クレジットカード"
Incidents where the damage spread through the same service or system.
- Bモスフードサービス（モス WEB 会員）2026.11.04 announced・Affected 7,500,000 records
- SSアイスタイル（@cosme）2026.11.02 announced・Affected 3,000,000 people
- Aディーエイチシー（DHC）2026.10.30 announced・Affected 5,096 accounts
- Aアドベンチャー（スカイチケット）2026.10.29 announced・Affected 32,341 records
- Bアイリスオーヤマ（アイリスプラザ）2026.10.29 announced・Affected Unknown
- SENEOSパワー（ENEOSでんき・でんきサービスのお客さまページ）2026.10.28 announced・Affected 57 people
Same attack method
- A佐川急便（お荷物問い合わせ）2026.10.01 announced・Affected 53,230,000 records
- SSソースネクスト2026.10.15 announced・Affected 22,519,960 records
- SSバーガーキング・ジャパン(公式アプリ)2026.10.15 announced・Affected 11,180,000 records
- SS焼肉きんぐ2026.10.05 announced・Affected 10,788,963 records
- SSタイムズカー(タイムズモビリティ)2026.09.25 announced・Affected 6,600,000 accounts
- Sブックオフグループ(ブックオフコーポレーション)2026.10.09 announced・Affected 6,383,279 people
Same industry
- SSライドオンエクスプレス（『銀のさら・釜寅・すし上等』公式サイト・公式アプリ）2026.10.13 announced・Affected 6,500,000 records
- SSニチレイグループ2026.09.18 announced・Affected Unknown
- Sアサヒグループホールディングス2026.07.17 announced・Affected 1,525,000 records
- S佐嘉平川屋2026.06.15 announced・Affected Unknown
- Aドトールコーヒー（社内システム・従業員と退職者の情報）2026.10.26 announced・Affected 951 people
- Aカルビー（絶品部「やめられない、とまらない」課）2026.10.09 announced・Affected Unknown
Attack method classification: Unauthorized access (method undisclosed)(Breached, but the technique was not identified or disclosed)
Read the Unauthorized access (method undisclosed) guide and national trends →