Pizza Hut Japan online ordering breach: email addresses, phone numbers and login session tokens leaked, and what customers should do

The company says third parties may use the leaked email addresses and phone numbers to send suspicious emails or texts, or make calls, impersonating the company or Pizza Hut. It asks customers not to click links or open attachments in unexpected messages.

Coupons, campaigns, apology points or order confirmations look natural to anyone who has ordered pizza, which makes fakes harder to spot. To check anything, use the official Pizza Hut app or the official website opened yourself (see What is phishing?).

The company asks customers not to enter or give out important information such as passwords or credit card details in response to such messages. A message that takes you to a login or payment page, or a call asking for a card number or verification code, should be treated as suspect for that reason alone.

The leaked information includes session login tokens (information that keeps you signed in) and transaction records. The announcement does not say whether the tokens were invalidated. Sign in through the official app or the website opened yourself, and check for orders you did not place and for changes to your registered email address, phone number or delivery address.

Pizza Hut Japan's helpline is 0120-679-023 (10:00 to 19:00, Japan time) and the inquiry form on its official website (pizzahut.jp/faq). Both are listed in the company's announcement. Use these rather than any phone number given in an email or text you received.

Passwords are not on the list of leaked information, and the company does not ask customers to change them. If you reuse the same password on other services, this is still a good moment to fix that, which also helps against future fake messages (Choosing a password manager).

According to the announcement, access came through a payment API, described as a mechanism that exchanges payment-related information between systems, and information was obtained from a database containing customer information. In general, APIs for system-to-system integration are often set up with broader database access than customer-facing screens. Check whether your integration APIs can read tables they do not need, such as member data, tokens or records of closed accounts.

Session login tokens were among the leaked items. In general, not storing tokens in plain form in the database (store a hash and compare), keeping their lifetime short, and being able to invalidate everyone's tokens at once if a leak is suspected all reduce the impact of a leak. Decide in advance how you would invalidate them and how you would tell customers.

Records relating to deleted customer information were among the leaked items. Limiting what you keep after an account is closed to what law or accounting requires, and deleting it after that period, reduces the number of people affected if an incident happens.