Pizza Hut Japan has confirmed a data breach affecting its Japan-only online ordering service. On 19 October 2026, a third party accessed a payment API connected to the service and obtained some information from a database holding customer information. The company published its notice on 23 October, and the first English-language report found followed on 24 October.
The affected service handles online orders for Pizza Hut customers in Japan. Neither the company notice nor the English report identifies any impact on Pizza Hut services in other countries. This is a Japan story: no global figure is claimed, and no other country’s customers are counted in it.
What Pizza Hut Japan confirmed
The route first. The company describes the payment API as the mechanism for exchanging payment-related information between systems. A third party accessed that API and obtained some information from a customer-information database. The company has not named an attacker, and no attacker claim is reported, so this article names none.
The categories confirmed as leaked, at this stage: customer IDs; email addresses; telephone numbers; records relating to deleted customer information; session login tokens; transaction records. Credit card information was explicitly not included, according to the company. That exclusion is stated plainly in the notice: card data is not part of what leaked, on the company’s account.
Response steps the company says it has taken: blocking the attacking IP addresses, addressing vulnerabilities, and submitting an initial report to Japan’s Personal Information Protection Commission. It also promises a review of system management practices and corrective measures. At the time of the notice, the company said it had not confirmed any secondary harm resulting from the breach, and that it continues to monitor the situation. That wording means no secondary harm had been confirmed at notice time. It does not establish that nothing was done with the data.
What is missing: the count, the window, the tokens
Three gaps define this story. First, the company gave no affected-customer count, and the English report states that explicitly. No number is estimated here, and none is borrowed from another company’s breach. Separately, Japanese reporting attributed to ANN put a possible maximum of approximately 4.48 million records: a media-reported estimate, not a company disclosure, and not a count from Pizza Hut Japan itself. Second, the company did not specify the period covered by the exposed records, so no window is claimed. Third, the session login tokens: whether they were still valid at disclosure, whether any account was taken over using a token, and whether any token has been revoked are all unconfirmed. The token risk, as the English report explains it in general terms, is that stolen tokens could potentially enable unauthorised access to an account, depending on their validity and the service’s security controls. That is a conditional warning, not a confirmed takeover, and this article keeps it that way.
The contents of the deleted-customer records and the transaction records are likewise unclear. The notice lists the categories without itemising them, so this article does not speculate beyond them. The root-cause vulnerability and the full scope are also still under investigation, according to the company, so no specific flaw is named as the cause.
Four days, then one more
As our analysis, built only from the confirmed dates: 19 October 2026 (unauthorised access confirmed) → 23 October 2026 (company notice) → 24 October 2026, 22:08 UTC (CyberInsider report). That is 4 calendar days from confirmed access to public notice, and 1 further day to the first English-language report found. The sources give no internal timeline, so the 4 days are an arithmetic gap between two reported dates, not a finding that the company delayed.
The missing company count is the point, and three other October 2026 Japanese disclosures show why. Each company counts in its own unit, so these figures are not one total, and none of these incidents is connected to Pizza Hut Japan. The table compares company disclosures only; the ANN estimate sits above, not in the table.
| Company | Disclosed figure (as reported) | What it counts |
|---|---|---|
| Sourcenext | 22,519,960 records may have leaked | Member-information records, per its 15 Oct notice |
| Capcom | 11,774,247 CAPCOM ID records | Account records, per Capcom’s 22 Oct notice |
| Burger King Japan | About 11.18 million app member records | App member records, per Impress Watch on its 15 Oct notice |
| Pizza Hut Japan | NO FIGURE DISCLOSED | Count not given in the company’s own disclosure; ANN separately reported a possible maximum of about 4.48 million records |
As our analysis: Pizza Hut Japan is the only one of the four whose own disclosure gave no number. A reader can see exactly what kind of data leaked, but the company’s own disclosure does not say how many people it touches. That gap is the story, and it stays open until the company’s investigation reports further.
For readers, the practical consequence is simple: nobody outside the company can confirm whether this touched hundreds of accounts or millions. The categories say what to guard against; the missing company scale says how widely to worry. A media-reported estimate of up to about 4.48 million records exists, but it is not company-confirmed. Until the investigation reports, both halves stay as they are.
What to do if you order from Pizza Hut Japan online
- Ignore unexpected messages claiming to be Pizza Hut about this incident.
- Do not click links or open attachments in any such message.
- Do not enter passwords or credit card information in response to such contact.
- Call Pizza Hut Japan on 0120-679-023 between 10:00 and 19:00 with questions.
The company itself gives that warning and contact line, plus an FAQ form, because the leaked addresses and numbers could be used for impersonation.
What to watch next
Three things would change this story: a company-disclosed count; a statement on token revocation or validity; and the root-cause finding.
This incident is separate from the 2017 Pizza Hut card breach and the 2023 Pizza Hut incident involving claimed order records, and separate from the Sourcenext, Capcom, and Burger King Japan disclosures above. None of their figures applies here.
Sources
- Pizza Hut Japan corporate notice, 23 October 2026 (Japanese, read in full)
- CyberInsider, 24 October 2026: “Pizza Hut Japan suffers data breach exposing customer information”
- ANN (TV Asahi) report, 23 October 2026 (Japanese, via Yahoo News): possible maximum of about 4.48 million records
- Business+IT, 24 October 2026 (Japanese): ANN figure and the company’s no-count position
- FourWeekMBA (comparison figures for Sourcenext and Burger King Japan, from company notices as reported there)
- Capcom notice, 22 October 2026 (Capcom figure)
Our earlier Capcom coverage, a separate incident: Capcom Data Breach: 11.7 Million CAPCOM ID Accounts Exposed. It is not connected to the Pizza Hut Japan incident.
