Matsuya app management system breach (2,377,127 records plus app members): names, phone numbers and delivery addresses leaked — what members should do

The leaked items include name and phone number, plus a delivery address (Matsuben Net and the others) or date of birth and email address (app members). With that much, a message can have the right name and the right address and look genuine.

If a message says points are expiring, your member rank is being reset, or offers an apology coupon or compensation, do not open its link; open the official site or official social accounts yourself and check (how to spot them: What is phishing?).

In a separate notice, the company says it will email a dedicated QR code, usable at ticket machines, by November 1, 2026 to people who bought the app version of MATSUYA PASS between September 26 and October 28, 2026. An email the company really is expected to send is exactly where fakes slip in.

Do not open links in such an email; check the company's official site for the announcement first. The company says it never asks for passwords or credit card data by email or phone.

For app members, an encrypted password, email address and date of birth leaked. The encryption method and strength have not been disclosed, so if you use the same password as your Matsuya account on other services, change it there first.

A password manager is the practical way to take stock. You can check whether a reused password appeared in past leaks with How to check if your password was leaked. The Matsuya app is suspended, so change the app-side password after it is restored, following the company's official guidance.

The data for Matsuben Net, Mobile Order and Matsuben Delivery includes your delivery address and phone number. A text posing as a courier ("we could not deliver" or "your address could not be confirmed") can look genuine if the name and address match, even though it has nothing to do with Matsuya.

Phone numbers and addresses are hard to change, so such messages may keep coming. Turning on your phone's spam call and spam text filters reduces them (Smartphone security basics).

The company lists a personal-information help desk for this incident (phone 0422-38-1121, weekdays 10:00 to 16:00, closed on weekends and holidays, press 1 after the voice guidance; the email address is also in its notice). Use contact details from Matsuya's official site, not ones written in a message you received.

The target here was a management system holding the data of app and ordering-service users. Admin screens and admin APIs carry more authority than customer-facing screens, so take stock of who can open them and from where.

Do not leave them open to anyone on the internet; restrict source addresses and require multi-factor authentication (see the multi-factor authentication guide).

Here, app members and users of ordering services such as mobile order and delivery were affected through what appears to be a shared management system. When services share a common platform, one breach can reach the users of several services.

Check which data sits on the shared platform and whether the range each service can view is separated. We also covered read-volume limits and notification in the Yakiniku King app case.

The company says it does not hold credit card data. In the same way, review regularly whether you keep items that ordering does not need (date of birth, past addresses and so on).

Never store passwords in plain text; store them with a strong, salted method (password storage, hashing and salt).