Gin no Sara Operator Warns Up to 6.5 Million Records May Be Exposed After Ransomware Attack

Customer Records at Risk Across Three Delivery Brands

Ride On Express Holdings announced on October 13, 2026, that up to approximately 6.5 million personal information records registered through the official websites and apps of Gin no Sara, Kamatora and Sushi Joto may have been exposed following a cyberattack on an external server. The potentially affected information includes home addresses, telephone numbers, dates of birth, password hashes and order histories.

The company has not confirmed that attackers took the information. At the time of its announcement, investigators had found no clear evidence of a leak and had not established whether a disclosure occurred or how much information was involved. The 6.5 million figure is the maximum number of potentially affected records, not a confirmed count of stolen records or a stated number of distinct people.

In its third incident notice, Ride On Express Holdings said the server operator reported a ransomware attack and subsequently warned that retrieving or restoring the data entrusted to it would be difficult. Ordering through the three brands' official websites and smartphone apps remained suspended, with no reopening date announced.

The company's October 13 second incident notice also disclosed the possible exposure, following its first notice on October 8. It apologized to customers, business partners and others affected, and said it had decided to notify potentially affected customers even though the investigation had not established a leak or its scope.

The disclosure widened an incident initially presented as a service interruption on October 7. It also extended the potential exposure beyond account holders: family details and information about delivery recipients may be affected where customers entered those details. Credit card information is excluded because the company says it does not hold it.

How the Incident Unfolded

The company's chronology begins before the ordering systems went offline. Ride On Express Holdings said it detected unauthorized access by a third party to servers it used from October 5 and started examining the attack route and possible damage.

A system failure occurred on some servers early on October 7. After the server operator reported a ransomware attack, Ride On Express Holdings stopped its systems and established an emergency response team that same day. The team began investigating possible information disclosure and considering measures to prevent further harm to customers.

• October 5, 2026, onward: Unauthorized access was detected, prompting an investigation into the attack route and possible damage.
• October 7: Some servers failed early in the morning. The operator reported ransomware, Ride On Express Holdings suspended systems, and an emergency response team was established.
• October 8 onward: Telephone orders, takeaway orders at stores and orders through Demae-can and Uber Eats were available. Official website menus and store searches were also operating.
• October 13: The company disclosed the possible exposure of up to approximately 6.5 million records, despite not having established a leak or its scope.

The company said the October 13 disclosure followed discussions within its emergency response team. It decided to inform potentially affected customers while the investigation was still unresolved, rather than wait for confirmation of information theft.

Which Information Could Be Affected?

The possible exposure covers people who previously registered information on the official websites or apps of any of the three brands. The notice does not limit the warning to recent orders or currently active customers, and it does not specify the earliest registration date included.

The listed information consists of names, addresses, telephone numbers, email addresses, gender, dates of birth, password hashes, order histories and Deli Point membership IDs. Deli Point is the rewards service shared by the three brands.

Where customers entered family members' names and birthdays, those details may also be affected. Names, addresses and telephone numbers entered for delivery destinations may be included too. That means the possible exposure reaches people whose information was entered by an account holder, even if they did not personally create an account.

Customers who ordered only through Demae-can, Uber Eats or by telephone are outside the stated scope. The word only matters: using one of those channels does not exclude someone who also registered information through an official website or app in the past.

What the Password Warning Means

Ride On Express Holdings lists password hashes among the potentially affected data. It describes that information as encrypted and unreadable in its stored form. A password hash is a transformed representation of a password, rather than the password written out as ordinary text.

The second incident notice's exact wording is: “パスワードは暗号化されており、そのままでは読み取りできない情報です。” In English, this means: “Passwords are encrypted and cannot be read as they are.”

That distinction reduces the immediate usefulness of a stored value to an attacker, but it does not establish that every password is secure. Depending on the hashing method and the password itself, attackers may attempt to identify a match by testing guesses. The notice does not disclose the hashing method or other technical protections, so it does not support a specific assessment of how resistant those values would be to such attempts.

The exclusion of credit card information is a separate point. The company says it does not retain that information, so it is not included in this incident's potential exposure. That does not remove the risks associated with contact details, delivery addresses or order histories, which could make fraudulent messages appear more convincing.

What Customers Can Still Use

The service disruption does not mean that all ordering has stopped. Ride On Express Holdings said that, from October 8, customers could place orders by telephone, arrange takeaway orders at stores, or order through Demae-can and Uber Eats.

Menu listings and store searches on the official websites were also operating. Those functions allow customers to check products and locate outlets, even though the websites' ordering functions remained suspended.

Ordering through the official smartphone apps was also unavailable. As of the October 13 notice, the company had no forecast for restarting either official ordering channel and said it would announce progress when available. The distinction is practical: browsing a menu or finding a store is possible, but completing an order requires one of the channels still operating.

Warnings and a Dedicated Contact Number

Ride On Express Holdings said it had not confirmed any secondary harm caused by misuse of personal information. It nevertheless urged customers to be cautious about suspicious telephone calls and emails, particularly messages requesting a password or containing an unfamiliar subject or unexpected content.

The company's advice is to avoid replying to suspicious emails or clicking their links, and to delete them. The warning addresses a possible consequence of exposure, not evidence that a specific fraudulent message campaign has already been connected to this incident.

The company established a customer information consultation line at 0120-782-272. Its published schedule is 10 a.m. to 8 p.m. every day through November 15, then 10 a.m. to 8 p.m. on weekdays from November 16 onward.

The second incident notice lists a separate corporate inquiry contact: Director and Executive Vice President Kazumasa Watanabe (渡邊一正), telephone 03-5444-3625. This is distinct from the customer consultation line.

Ride On Express Holdings also said it would send apologies and guidance to potentially affected customers in stages. It did not give a completion date for those notifications. People concerned about whether their past registration falls within the warning can use the dedicated consultation number.

A Separate Cloud Disruption Affected 495 Organizations

A ransomware incident at IDC Frontier's IDCF Cloud service occurred during the same period. IDC Frontier, a subsidiary of SoftBank, operates the platform. The disruption affected 495 companies and organizations, showing how a failure at a shared cloud service can interrupt many otherwise separate operations.

Some virtual servers in part of the platform's East Japan Region 1 stopped operating at approximately 3:40 a.m. on October 7. Virtual servers are computing environments that run on shared physical infrastructure. IDC Frontier said retrieving or restoring data stored in the affected zone would be difficult.

IDC Frontier confirmed that it had detected a third-party attack and that it was a ransomware attack. The affected East Japan Region 1 is in Shirakawa, Fukushima Prefecture. The company said that the impact confirmed at that point was confined to that region and that it was also checking the safety of other areas.

The disruption extended beyond websites. A logistics subsidiary of food producer Nissui said it could neither receive nor ship goods at any of its 17 distribution centers across Japan. Websites serving local government and the police headquarters in Ibaraki Prefecture were also inaccessible.

IDC Frontier said it shut down the affected system to prevent further damage and was checking whether information had leaked. However, Ride On Express Holdings has not identified its server operator. The similar timing and warnings about data recovery do not establish that the restaurant company's incident occurred on IDCF Cloud.

What Is Confirmed and What Is Unresolved?

The confirmed events in Ride On Express Holdings' account are unauthorized access detections, server failures, the operator's report of ransomware, the suspension of systems and difficulty retrieving or restoring stored data. Whether personal information was actually disclosed remains unresolved.

Loss of access to data and theft of data are different outcomes. Ransomware can prevent legitimate users from accessing files or systems; an information leak involves data reaching an unauthorized party. Evidence of one does not, by itself, prove the other. That distinction explains why the company can report a serious service interruption while still treating the 6.5 million records as potentially exposed.

The company said it had reported the incident to Japan's Personal Information Protection Commission and the police station with jurisdiction. It also pledged to strengthen its information security arrangements, but the notice did not set out specific technical changes, an investigation completion date or a recovery timetable.

The second incident notice said its emergency response team was working to restore the systems and taking measures to minimize disruption to business operations. It also said the company had arranged to direct customers to available ordering channels and expected that returning to normal operations and service would take additional time. It did not describe specific technical security measures.

The outstanding issues are therefore concrete: whether information left the affected environment, which records were involved, whether data can be recovered and when official ordering will resume. The notice provides dates for changes to consultation line hours, but no deadline for resolving those questions.

Key Points

• Up to approximately 6.5 million records registered through Gin no Sara, Kamatora and Sushi Joto websites and apps may be affected.
• As of October 13, 2026, no clear evidence of a leak had been found, and its occurrence and scope were unconfirmed.
• Potentially affected data includes contact details, birthdays, password hashes, order histories and some family and delivery recipient information.
• Credit card information is excluded. Customers who ordered only by telephone, Demae-can or Uber Eats are outside the stated scope.
• Official website and app ordering remained suspended, while telephone, store takeaway and external delivery platform orders were available.
• The customer consultation number is 0120-782-272, with published hours of 10 a.m. to 8 p.m.
• A separate IDC Frontier cloud incident affected 495 organizations, but Ride On Express Holdings has not named its server operator.