Pizza Hut Japan has disclosed a data breach affecting its online ordering service after an unauthorized third party accessed a payment API and obtained customer information.
The company confirmed the unauthorized access on October 19, 2026, and publicly disclosed the incident on October 23. Its investigation into the cause and full scope of the breach remains ongoing.
According to the announcement, the intruder accessed an API used to exchange payment-related information between systems and retrieved information from a database containing customer data.
The affected service handles online orders for Pizza Hut customers in Japan. The disclosure concerns the chain’s Japanese operations and does not identify an impact on services in other countries.
The company listed the following categories of information as confirmed exposed:
- Customer IDs
- Email addresses
- Telephone numbers
- Records relating to deleted customer information
- Session login tokens
- Transaction records
Pizza Hut explicitly stated that the breach did not include credit card information. However, it did not provide an affected customer count or specify the period covered by the exposed records.
The inclusion of session login tokens raises an additional security concern. These tokens generally allow a service to recognize an authenticated user without requiring a password for every interaction. Depending on their validity and the service’s security controls, stolen tokens could potentially enable unauthorized access to an account.
The disclosure also included records related to deleted customer information, though their contents remain unclear.
Pizza Hut said its response included blocking the attacking IP addresses, addressing vulnerabilities, and submitting an initial report to Japan’s Personal Information Protection Commission. It also plans to review its system management practices and implement corrective measures.
At the time of the announcement, the company said it had not confirmed any subsequent harm resulting from the breach.
Customers should remain alert for phishing emails, text messages, and telephone calls impersonating Pizza Hut. Exposed contact information could help scammers target people with convincing messages about their accounts or orders.
Pizza Hut advises recipients of unexpected communications to avoid clicking links or opening attachments and never provide passwords or credit card details in response.
Leave a Reply