What happened
Monogatari Corporation, owner of the Japanese yakiniku chain Yakiniku King (焼肉きんぐ), announced on October 5, 2026 that data of 10,788,963 members of its official app leaked. That's practically the whole base: the app had 10,808,784 registrations.
Timeline (per the company)
- October 2: unauthorized third-party access confirmed in the app's member-management system. The company cut off communications and put defenses in place.
- October 3: data leak confirmed.
- October 5: public notice; report to the Personal Information Protection Commission (PPC) and a police damage report.
What leaked and what didn't
| Leaked | Not leaked (per the company) |
|---|---|
| Member number | Login password |
| Name registered in the app | Date of birth, gender, postal code |
| Visit history and points | |
| Phone number | Payment data (never held) |
The cause hasn't been disclosed; the investigation continues with the app developer. As of October 5 there was no sign of publication or misuse. The group's other brand apps got the same protections, and the company says no leak occurred there.
Why it's dangerous even without passwords
Name + phone + email + member number together enable very convincing scams: emails or texts about an "apology coupon," "bonus points" or "refund" with your correct name and number. A scammer who knows these details is not legitimate because of it. Phone numbers are hard to change, so the risk lasts for years.
What members should do
- Don't click links in messages claiming to be Yakiniku King. Check coupons and points by opening the official app yourself.
- Never enter card details or passwords on a page reached via a link. The company says it won't ask.
- If you reuse the password elsewhere, change and separate it (a password manager helps).
- Turn on spam call and text filters.
- Contact the company only via the number on its official site (app call center: 0120-795-775).
Lessons for businesses running member apps
The leak hit over 99% of the base from a single system. Even without knowing the cause, review:
- Cap how many records one operation or account can read or export at once; full exports only with approval.
- Monitor rows read per hour in the member DB and alert on deviations.
- Map every path that can read the whole base (admin panel, maintenance, development), close unused ones, and require MFA and source restrictions on the rest.
- Minimize data: keep only what you need.
- Have a response plan ready to notify customers and regulators quickly.
Sources
- ITD (summary of the official notice): https://itdef.net/en/learn/yakiniku-king-app-data-breach-2026
- Monogatari Corporation, notice of Oct 5, 2026: https://www.monogatari.co.jp/
Want to review the security of your company's member app or system? KGA IT offers a free consultation: kga-it.com.