Ride On Express Holdings said on 13 October that up to about 6.5 million records from its delivery brands' official websites and apps may have been exposed in a cyberattack. It has not confirmed that any data left its systems, and ordering through those channels remains suspended.
What the company says
The TSE Standard-listed company (code 6082) issued a second report on the system failure it first disclosed on 8 October. Its subsidiary, Ride On Express Co., detected unauthorised third-party access to the servers it uses from 5 October, and a system failure has run since the early morning of 7 October.
After investigating, the company said it has not identified a clear trace of a personal-data leak, nor established whether or how far one occurred. It decided to notify customers who may be affected and to make the matter public.
The data at issue
The records are registrant information from the official websites and apps of Gin no Sara, Kamatora and Sushi Jouto. The company put the figure at up to about 6.5 million records and stressed that it is the total that could have leaked, not a count of confirmed leaks.
The items that may be affected are:
- name, address, phone number and email address
- gender and date of birth
- hashed password
- order history
- Deli Point member ID
The company said the passwords are encrypted and cannot be read as they stand. Family members' names and birthdays, and delivery recipients' names, addresses and phone numbers, may also be affected if customers entered them. Customers who ordered only by phone are outside the scope. Credit card data is not held by the company and so is not covered.
Orders and response
Orders through the official websites and apps remain suspended. Customers can still order by phone, through in-store takeaway, and via Demae-can and Uber Eats, and the company said it is set up to direct customers to the channels that work. It expects a return to normal operations and service to take some more time.
The company said it is reporting the possible leak to the Personal Information Protection Commission and the police with jurisdiction, and will send apologies and guidance to affected customers in turn. An emergency response team is working on recovery.
Earnings
The company is still assessing the effect on group results and said it will disclose promptly if the impact proves material. The notice gives no recovery date for web and app ordering and does not say who carried out the attack.