Denny's Japan said on November 3 that its Denny's app, which handles coupons and loyalty points for the restaurant chain, was accessed without authorization by a third party, and that some users' personal information may have leaked outside the company.
The breach came through the system process that migrates users from the old Denny's app to the new one. A third party improperly created authentication credentials there, leaving some users' accounts reachable. The company has not determined how many people are affected.
The information that may have leaked covers some users of the old app: membership codes, email addresses, dates of birth, gender, prefecture of residence, favorite stores and kids' birthdays — the birthdays of users' children, kept for promotions.
Denny's Japan said it does not hold names, addresses, phone numbers, passwords or credit card details.
What the company has confirmed
The findings so far cover access records from October 7. Investigation of other periods is still under way, so the full scope and the number of people whose data may have leaked are not settled.
On October 30, while looking into suspicious access, the company confirmed that authentication credentials tied to the old app had been improperly created. It modified the system the same day to block new fraudulent credentials, and disabled the improper credentials on October 31. On November 2, further investigation turned up more fraudulent credentials, which were also disabled.
The company has confirmed a record of a system process that retrieves personal information being run. It cannot tell whether a third party or the customer themselves ran it, so it does not yet know whether any data was taken, what it contained or how many people it covered.
Because of the countermeasures, some users may see the app's opening screen and be asked to log in again when they launch it.
Denny's Japan is working with a dedicated internal team and its system developer to establish the cause and the scope. It will contact affected users individually once they are identified.