Gin no Sara operator warns up to 6.5 million records may have leaked
In short
Raido On Ekusupuresu Horudingusu (ライドオンエクスプレスホールディングス), operator of sushi delivery service Gin no Sara (銀のさら), said on October 13 that up to about 6.5 million registered-user records may have leaked after a cyberattack. Website and app ordering remains suspended, and the company said it has not established whether information actually leaked or the extent of any leak.
Read the full story 1 min read
The operator of Gin no Sara (銀のさら) said on October 13 that a cyberattack on an external server may have exposed up to about 6.5 million records belonging to users of its official websites and apps. Raido On Ekusupuresu Horudingusu (ライドオンエクスプレスホールディングス) said the potentially affected registrations cover Gin no Sara, Kamatora (釜寅) and Sushi Joto (すし上等). It said clear evidence of information leakage had not been found and that whether a leak occurred, and its scope, remained undetermined. [ 4 , 6 , 11 ]
Potentially affected information includes names, addresses, telephone numbers, email addresses, gender, dates of birth, password hashes and order histories, ITmedia reported. Depending on registration details, family members' names and birthdays and delivery recipients' names, addresses and telephone numbers may also be involved. The company said credit card information is excluded because it does not hold it. Users who ordered only by telephone, Demaekan (出前館) or Uber Eats are not affected, according to ITmedia. [ 4 , 6 ]
The company said it detected unauthorized access to the server from October 5 and began investigating. Some servers suffered system failures early on October 7, and the server operator reported a ransomware attack. The company then stopped its systems. ITmedia reported that the server operator subsequently said retrieving or restoring the entrusted data would be difficult. The company has not named the server operator. [ 6 , 8 , 11 ]
Website and app ordering remains suspended, with no prospect for resumption established as of October 13, the company said. Telephone, in-store, Demaekan and Uber Eats orders are still accepted. The company said it reported the incident to the Personal Information Protection Commission and police and would notify potentially affected users. It said no secondary harm from misuse of the information had been confirmed and urged caution about suspicious calls and emails. [ 3 , 6 , 8 ]
Why it matters
Potentially affected information includes names, addresses, telephone numbers and dates of birth, while credit card data is excluded, the company said. It is notifying potentially affected users and warning them about suspicious calls and emails.
Key facts
- The operator said up to about 6.5 million records registered through official websites and apps may have leaked. [ 1 , 3 , 4 , 6 , 7 , 11 ]
- The company said credit card information is not included because it does not hold that data. [ 4 , 6 ]
- Website and app orders remain suspended with no reopening date established as of October 13. [ 3 , 6 ]
- The company said clear evidence of a leak, its occurrence and its scope had not been established. [ 6 , 11 ]
Confirmed by several sources
Still unclear
- Whether information actually leaked and the scope of any leak remain undetermined. The company said clear evidence of leakage had not been confirmed as of October 13.
- A date for resuming website and app orders is not established. The company said it had no prospect for resumption as of October 13.