One app was breached, and names, emails and phone numbers in 10,788,963 member records leaked together

At a glance

In the Yakiniku King data breach, names, email addresses and phone numbers in 10,788,963 of 10,808,784 registered app member records leaked together. Even without passwords or card numbers, that bundle is enough for someone to pose as the company by email, text message or phone. If you run a member app, my answer is to stop collecting customer data you do not need, and to run the business without holding passwords or card numbers. The company has not disclosed the cause.

The app held names and phone numbers to link members to the in-store reservation system. Only after the incident did the company say it will move, from the first half of 2027, to a system that does not store them. Data kept "because we need it" became the size of the incident. If your business keeps a customer list, read this as your own story.

When

• From 9:00 a.m. on Friday, October 2, 2026, an outside party attacked the system on and off.
• The same day, the company detected the unauthorized access and cut the connection.
• On Saturday, October 3, it confirmed that data had leaked. On Monday, October 5, it published an apology.

Who

• Operator: Monogatari Corporation (株式会社物語コーポレーション), which runs several restaurant brands in Japan, including the yakiniku (Japanese barbecue) chain Yakiniku King (焼肉きんぐ).
• What was attacked: the member management system of the official Yakiniku King app.

What leaked and how much

• Leaked: member number, name (as registered in the app), email address and phone number. 10,788,963 records.
• Held by the company but, it says, not leaked: login password, date of birth, gender, postal code, and store usage history including points balance.
• Never held: payment information such as credit card data.
• The unit is records (件), not people. That is how the company reported it.

Why (official statements only)

• The company has not disclosed the cause or the way in. Its second notice on October 20 does not include it either.
• So this article treats the cause as unknown.

Where things stand now

• The app was not shut down. It kept running after defensive measures.
• The company has reported the incident to the police. Its report to the PPC (Japan's Personal Information Protection Commission, the privacy regulator) was "in progress" as of October 20.
• It says it has also briefed the relevant government ministries and is working on prevention while seeking their advice.
• From the first half of 2027, all 11 official apps run by the group will stop storing names and phone numbers.
• As of October 5, the company said it had not confirmed that the data was published or misused. It also warned members about fake emails, text messages and calls pretending to be from the company.

If you have used the app

• Your name, email and phone number may have leaked as one set. Expect emails, text messages or calls that use your real name and claim to be Yakiniku King or Monogatari.
• The company says it will never ask for your password or credit card details. Do not answer such requests.
• To check a message, do not use the contact details in it. Use the company's dedicated call center: 0120-795-775, 10:00 to 18:00, including weekends and holidays.

What to check in your own company today

1. For each customer data field, write one line on why you hold it. Delete any field you cannot justify.
2. List the data you collect only to link with another system, such as reservations, points or coupons. Check whether that link really needs it.
3. If an outside vendor built your app or member system, ask them who is watching it (monitoring and logs).
4. Tell your customers now: "We never ask for your password or card number by email or phone." Saying it after an incident is too late.
5. Decide who announces what, and by when, if you have a breach. This company took three days, from detecting the access on October 2 to announcing on October 5.

What happened at Yakiniku King?

Here is how this Japan restaurant app data breach unfolded.

• April 1, 2019: The official Yakiniku King app launched at 216 stores across Japan, with points, coupons and queue booking. (company press release, @Press¹)
• 9:00 a.m., Friday, October 2, 2026: An outside party began attacking. The company called it "intermittent," meaning on and off. (company's second notice²)
• The same day: The company detected unauthorized access to the member management system, cut the connection and took defensive measures. (company's first notice³)
• Saturday, October 3: The company confirmed that member data had leaked. It has not said how it confirmed this. (company's first notice³)
• Monday, October 5: The company published an apology, and Japanese media reported it the same day. (Nikkei⁴, INTERNET Watch⁵)
• October 20: A second notice set out stronger security and privacy measures. (company's second notice², group site notice⁶)
• As of November 4: I found no new notice about the incident after October 20 on the first page of the company's news list. (company news list⁷)

Taken together, the two notices list these responses. (first notice³, second notice²)

• Cut the connection and took defensive measures on October 2. The app kept running.
• Stronger security and monitoring "with the cooperation of the development company and related companies."
• Reported to the police. The report to the PPC was in progress as of October 20.
• Briefed the relevant government ministries and is drawing up prevention measures while seeking their advice.
• "Considering" an AI-based detection system. This is about defense.
• All 11 group apps will stop storing names and phone numbers (planned for the first half of 2027).
• A dedicated call center: 0120-795-775, 10:00 to 18:00, including weekends and holidays.

Neither notice mentions compensation, apology coupons or bonus points.

What data was leaked in the Yakiniku King breach?

The company published only two numbers: 10,808,784 registered records, and 10,788,963 leaked records, about 10.79 million. (company's first notice³)

Four fields leaked: member number, name (as registered in the app), email address and phone number.

"Name" means the name the member typed into the app. Some people may not have used their real name, but the company has not said how many.

Read the unit carefully. These are member records, not members. The company did not publish a count of people.

Was payment information exposed?

No. The app never held it. The company says credit card and other payment information is "not held by our company" (「当社で保持しておりません」).

The items that did not leak fall into two groups, and they mean different things.

• Held, but not leaked this time: login password, date of birth, gender, postal code, and store usage history including points balance. This is the company's statement about this incident.
• Never held: payment information. There was nothing to steal.

According to the company, the first group did not leak this time. The second group could not leak at all.

Who was affected, and what about the group's other apps?

People affected

• Customers who registered in the Yakiniku King app. 10,788,963 records.
• There is a gap between registered and leaked records. The company has not said which accounts make up the difference.
• The notices say nothing about customers who only visited stores without the app, or about employees or franchise stores. (first notice³, second notice²)

Other brand apps

• Yakiniku King is the only app with a confirmed leak.
• The company said it took the same measures for its other brands' official apps and that no leak occurred there. It did not name those apps. (first notice³)
• According to Nikkei, the apps of two other group chains, Marugen Ramen (丸源ラーメン) and the shabu-shabu chain Yuzuan (ゆず庵), were not attacked. (Nikkei⁴)
• The October 20 notice says the group runs 11 official apps in total, but names only Yakiniku King. (second notice²)

The other apps are still part of this story. All 11 will move to a new system that does not store names and phone numbers.

Why do news reports give different numbers?

There is one official figure: 10,788,963 leaked records. The rest are rounded or reworded.

• "About 10.78 million," "about 10.79 million" and "over 10 million" are rounding differences.
• Some outlets added a percentage. Nikkei wrote "more than 90 percent." The company did not publish a percentage.
• Some headlines counted people, such as "10.78 million people." (ASCII.jp⁸) The company's unit is records.
• Home addresses were not among the leaked fields, and the company says postal codes did not leak either.

What caused the breach?

The cause has not been disclosed. The company has not published the cause or the way in, and its October 20 notice does not include it. (second notice²)

The company only wrote that it is strengthening security and monitoring "with the cooperation of the development company and related companies." It did not name the developer. (first notice³)

Some articles online guess at the cause. The company has not confirmed any of them, so I do not repeat them here.

What are the risks when a name, email and phone number leak together?

With a name, an email address and a phone number, someone can contact a person while pretending to be the company. This is the raw material for phishing: a scam where someone poses as a real company to trick you into handing over information.

The company warned that the data could be used for fake emails and phishing scams. It asked members to watch for suspicious emails, text messages and calls, and said it will never ask for a password or credit card details. (first notice³)

The October 20 notice only says the company is working with the relevant bodies in case of secondary damage. No count of actual secondary damage has been published. No source says who the attacker was, whether money was demanded, or whether the data was posted anywhere.

A password that did not leak does not stop impersonation. The message can still look real because the name and number are real.

Why did the app hold names and phone numbers at all?

This is the part of the incident I think matters most.

The company explains that its apps collected names and phone numbers to link with the store reservation system, so it could confirm bookings and guide customers. (group site notice⁶) Nikkei also reported that the system handles store reservations, member management and coupons based on visit history. (Nikkei⁴)

After the incident, the company decided the following. (second notice²)

• In the first half of 2027, all 11 official apps will move to a new system that does not store names or phone numbers.
• Email addresses will still be collected for now, for reservations. Later, the company plans a system that holds no personal data, email included.

Seen from the other side, the payment information the company never held could not leak. You cannot lose data you do not have.

Was AI used in this attack?

There is no official announcement or media report that AI was used in this incident. The only AI the company mentioned is a detection system it is "considering." That is about defense.

Still, what people call AI cyber attacks, attackers using AI to find weak points and even build the attack, is no longer theory.

• Anthropic said that in testing its model Claude Mythos Preview, it found thousands of high-severity vulnerabilities in major operating systems and browsers. The model has not been released to the public. (Anthropic, Project Glasswing⁹, Mythos Preview assessment¹⁰)
• The security company Wiz said it used AI to find "PHP2Shell," a remote code execution flaw in the PHP engine. That kind of flaw lets someone outside run commands on a server. (Wiz blog¹¹)
• Amazon said it saw attempts to exploit that flaw four days before it was made public. (AWS Security Blog¹²)
• In the same month of October, GMO Cybersecurity by Ierae (GMOサイバーセキュリティ byイエラエ), a Japanese security firm, reported finding ARTEX, an AI penetration testing tool, on attack infrastructure aimed at about 20 Japanese companies. (GMO Ierae report¹³)
• That report names no victim companies. Neither Yakiniku King nor Monogatari appears in it.

So I think we should prepare on the assumption that people with bad intent use AI like this. If machines can now find weak points faster, and more of them, than people searching by hand, then cutting down the data you have to protect is the surest preparation.

The cause of this incident has not been disclosed. Even so, as the examples above suggest, attackers can now use AI to look for gaps that can be seen from the outside. That is why I believe we should check our own outside first.

What does this mean for your business?

I see three lessons for app operators.

First, a company that holds less loses less. This is the lesson I think matters most. Do not collect customer data you do not need in the first place. This is what privacy people call data minimization. The names and phone numbers held "for reservations" leaked for almost every registered record. Only after the incident did the company decide to stop storing them from the first half of 2027. Write down, field by field, why you hold each piece of data, and delete what you cannot justify before an incident, not after.

Passwords and card numbers in particular are better left out of your business entirely. Then a break-in somewhere is less likely to become a major incident. This company never held payment information, so none could leak. It did hold passwords and birth dates, and by its own account those did not leak.

By "not holding passwords," I mean three things.

• Do not take passwords at all. Use a login from an outside service, such as LINE Login.
• When a password must travel, send it only over an encrypted connection.
• If you do store one, store it only in a form that cannot be turned back into the original text (hashing).

Second, one app can change the whole company's plans. The Monogatari Corporation breach started with a single app, yet it is changing the systems of all 11 group apps. The market reacted quickly. According to Nikkei, at 10:50 a.m. the next day, October 6, the company's shares were at ¥5,230, down ¥320 (5.76%) from the previous day. That was an intraday price, not the close. (Nikkei¹⁴) Any effect on customer visits can only be judged from the October monthly figures, the first month after the incident. As of November 4, the latest monthly report the company had published was for September, before the incident. (company's September monthly report¹⁵)

Third, a customer list is raw material for fraud. A name, email and phone number are enough to contact your customers while posing as you. A notice that says "We never ask for your password or card number" only works if you send it before an incident. And decide in advance whether you could open an inquiry line that also answers on weekends and holidays, as this company did.

What happened (based on official announcements)

• October 2, 2026 (Fri), 9:00 a.m.: Intermittent unauthorized access by an outside party to the app's member management system begins. ²⁶
• October 2, 2026: The company detects the unauthorized access, cuts the connection and takes defensive measures. ³
• October 3, 2026 (Sat): The company confirms that member data leaked. ³
• October 5, 2026 (Mon): Apology published. 10,788,963 of 10,808,784 registered records leaked; fields: member number, name (as registered in the app), email address, phone number. Dedicated call center opened. ³
• October 20, 2026: Second notice. Reported to the police; PPC report in progress; government ministries briefed and advice sought on prevention; AI-based detection system under consideration; all 11 group apps to stop storing names and phone numbers from the first half of 2027. ²⁶
• As of November 4, 2026: No new notice about the incident after October 20 on the first page of the company's news list. Cause and way in not disclosed. ⁷

Companies that disclosed damage and what leaked

• Items the company says did not leak: login password, date of birth, gender, postal code, store usage history including points balance. Payment information is not held. ³
• No impact reported: the company says it took the same measures for its other brands' official apps and found no leak there (it did not name the apps). ³

As of November 4, 2026. Each company's notices may change after this date.