The Monogatari Corporation (TSE Prime: 3097) said 10,788,963 of the 10,808,784 registered users of its Yakiniku King official app had member information leaked after a third party gained unauthorised access to the app's member management system. The company disclosed the breach in a notice dated 5 October 2026.
Timeline and scale
Monogatari said unauthorised access was confirmed on Friday 2 October. It cut communications and put defensive measures in place, but confirmed on Saturday 3 October that member information had leaked.
The leaked data includes member numbers, names as registered in the app, email addresses and phone numbers. Monogatari said login passwords, dates of birth, gender, postcodes and store-use history, including held points, were not leaked. It said it does not hold credit card or other payment information.
What the company says about misuse and cause
As of the disclosure, Monogatari said it had not confirmed that the leaked data was made public to an unspecified audience or misused. It warned that the data could be exploited in spoofed emails and phishing, and asked customers to be wary of suspicious emails, texts and calls. It said it never asks customers for passwords or card details.
The cause, and how the access became possible, are still under detailed investigation. Monogatari said only that it has confirmed the incident was unauthorised access by a third party. The notice does not say who was responsible or how the attackers got in.
Response and open items
The Yakiniku King app is still running, with defences against outside access in place. Monogatari said its other brands' official apps have the same measures and show no sign of a leak.
The company said it will further strengthen security and monitoring with its developer and affiliated companies. It also said it is proceeding with a report to the Personal Information Protection Commission and a police damage report.
The effect on group earnings is still being assessed. Monogatari said it will announce further facts if the investigation turns them up, and will disclose anything else that requires it.