Ride On Express: Ransomware at Third-Party Server Puts Up to 6.5M Sushi Delivery Accounts at Risk

"Ride On Express Holdings (TSE Prime: 6082), the Japanese operator of the Gin no Sara, Sushi Joto and Kamatora sushi delivery brands, disclosed on October 13, 2026 that personal information tied to up to about 6.5…"

Ride On Express Holdings (TSE Prime: 6082), the Japanese operator of the Gin no Sara, Sushi Joto and Kamatora sushi delivery brands, disclosed on October 13, 2026 that personal information tied to up to about 6.5 million registered accounts may have been exposed. The cause was a ransomware attack on an external server operated by an outside provider. The company found unauthorized access from October 5. Online ordering through the brands' official websites and apps has been suspended for about a week, and on October 13 the company said it had no restart date. All eight sources available for this brief are secondary: news outlets, Japanese incident aggregators and IR-disclosure mirrors. None is the company's original notice, although several quote it closely. The sources agree on the 6.5 million ceiling. They also agree that the company has not confirmed any data was actually taken.

What Happened

Pieced together from the company's Tokyo Stock Exchange (TSE) disclosures and secondary reporting, the timeline runs as follows:

October 5: Unauthorized access to an external server is detected. LiveMakers and Matrix News both cite this date from the company's notice.
October 7 (early morning): A system failure begins on the official websites and apps, according to LiveMakers. Jiji Press, carried by The Japan Times and Nippon.com, says orders have been suspended "since Wednesday", which was October 7. Incident Radar puts the start of the order suspension at October 8. Sources differ by about a day on when ordering stopped. This probably reflects the gap between when the failure began and when the suspension was announced.
October 8: Ride On Express Holdings files its first TSE notice, describing a "system failure" in "an external server/system used by a consolidated subsidiary." It says an emergency response team is in place, that it is investigating "whether any information leakage has occurred," and that corporate systems, its website and email are running normally (Japan IR).
October 13, 16:00 JST: A second TSE timely disclosure (ufocatch, Japan IR) reports possible exposure of up to about 6.5 million records. The company's own website calls this notice its third report, while the TSE filing calls it the second (LiveMakers, Incident Radar). Readers following the numbered updates should be aware of that mismatch.

The company has reported the incident to Japan's Personal Information Protection Commission (PPC) and to police. It says it will contact potentially affected customers directly. It also says the financial impact is still being assessed and that it will disclose any material impact (Japan IR, Matrix News).

Ordering by phone, in-store takeout, and orders through Demae-can and Uber Eats are still available.

What Was Taken

No confirmed exfiltration yet. The company says it has not identified "clear traces or the scope of personal information leakage" (Japan IR) and that no secondary harm has been found so far (LiveMakers, Matrix News). The 6.5 million figure is the total population that could be affected, not a confirmed count of stolen records.

Volume: Every source gives "up to approximately 6.5 million." The unit differs between them: "registered customers" (Jiji), "accounts" (Matrix News), "pieces of personal information" (Japan IR's rendering of the filing) and "件", meaning records or items (LiveMakers, Incident Radar). These are not interchangeable. 6.5 million records could cover fewer than 6.5 million unique people. Treat the figure as an upper bound on records.

Scope: Anyone who registered on the official Gin no Sara, Kamatora or Sushi Joto websites or apps. People who only ordered by phone or through Demae-can or Uber Eats are not affected.

Data types: Japanese-language sources that summarise the company notice (LiveMakers, Incident Radar) list more fields than the English wire coverage:

Name, address, phone number, email address, gender, date of birth
Order history and Deli-Point loyalty member ID
Passwords, stored as hashes
Family members' names and birthdays, where users entered them
Delivery recipients' names, addresses and phone numbers, where users entered them

Jiji's English report (Japan Times, Nippon.com) gives a shorter list and calls the passwords "encrypted." The sources closer to the company's notice (LiveMakers, Incident Radar, Matrix News) say "hashed." We follow the hashed description. No source states the hashing algorithm or whether salting was used.

Not affected: Credit card data. The company says it does not store card details.

The third-party recipient and family-member fields matter. They mean people who never signed up for the service may also be exposed.

Why It Matters

Third-party hosting is the weak point again. Ride On Express's own corporate systems were not hit. The attack landed on an outside server run by a provider the company has not named. LiveMakers reports that the provider told Ride On Express the stored data would be difficult to retrieve or restore. That suggests a successful encryption event against the primary customer data store, with recovery in doubt. It also explains why a seemingly straightforward ordering outage has run for a week.

It is part of a wider pattern in Japan this month. LiveMakers places this incident alongside Daiichikosho's report of about 8.72 million records at risk from malware at a contractor, and East Japan Railway (JR East) and View Card's report of up to about 6.09 million records. On the same day as Ride On Express's disclosure, Jiji reported that Central Japan Railway (JR Central) may have leaked data on about 15,000 e-commerce users after unauthorized access at IDC Frontier, a SoftBank cloud subsidiary. Nothing in the sources links IDC Frontier to the Ride On Express incident, and we do not suggest a link. Taken together, though, the incidents point to sustained pressure on Japanese outsourced hosting and service providers.

The data is well suited to fraud. Names, home addresses, phone numbers, birth dates and full order history give fraudsters what they need for convincing "order confirmation" or "refund" lures by email, SMS and phone, as LiveMakers notes. Food delivery order history also shows household routines and when people are home.

Modern ransomware usually means theft too. Most current ransomware operations steal data before encrypting it so they can threaten to publish it. Ride On Express has not found evidence of exfiltration, but the absence of evidence this early in a third-party incident is weak reassurance. Defenders should plan as though the data is exposed until forensics shows otherwise.

The Attack Technique

Few technical details are public. What the sources establish:

Vector: Ransomware attack on a server run by an external operator that hosted Ride On Express customer data (LiveMakers, Incident Radar, Matrix News).
Detection: Unauthorized access detected from October 5. Service failure followed on about October 7.
Impact: Disrupted ordering systems, and data the hosting provider reportedly said was difficult to extract or restore.

What is not known:

The name of the hosting or service provider
The ransomware family, or whether any threat actor has claimed the attack. No source names one, and we have found no leak-site listing in the material reviewed.
How the attacker got into the provider's environment, such as exploited edge devices, stolen credentials or remote maintenance access
Whether other customers of the same provider are affected
Whether data was exfiltrated, and how much

Readers should not attribute this incident to any specific group until a claim or forensic finding appears.

What Organizations Should Do

Inventory every third party that holds customer data. Know which vendors store personal data, where it sits, and in what form. As LiveMakers puts it, if you don't know where you've placed data, you will be slow both to shut things down and to count what was exposed. Japan's PPC guidelines on supervising contractors already require this.
Write ransomware notification and recovery terms into hosting contracts. Require prompt incident notification, forensic cooperation, defined restore-time objectives and tested backups held separately from the provider's production environment. Keep your own recoverable copy of critical customer data so a vendor's encryption event does not stop your business.
Collect less and keep less. Family birthdays and third-party recipient addresses greatly enlarge the exposure in this breach. Review whether optional fields are needed, and purge data from inactive accounts on a set schedule.
Check credential storage. Confirm that passwords are hashed with a modern, salted, memory-hard algorithm such as Argon2id or bcrypt, not a fast hash or reversible encryption. If your customers overlap with Gin no Sara's, watch for credential stuffing against your own login pages and consider forcing resets for accounts that reuse credentials.
Prepare for phishing that impersonates the brand. Organizations with a breached brand of their own, and users of these services, should expect lures posing as order confirmations, refunds or "security updates" that ask for passwords. Ride On Express has warned customers not to reply to or click links in suspicious emails asking for passwords, and to be wary of unexpected calls. Its helpline is 0120-782-272, open daily 10:00–20:00 until November 15 and on weekdays after that.
Limit and monitor vendor connectivity. List every remote maintenance path and integration into vendor-hosted systems. Disable those that are not in use, enforce MFA, and log access so you can confirm or rule out lateral movement quickly when a provider reports an incident.

Sources: Customer data breach suspected at sushi delivery operator - The Jap... | Up to 6.5 million customer records may be exposed in Japan sushi cy... | 📡 Signal｜ライドオンエクスプレス、「銀のさら」など最大約650万件に漏えいの可能性 | RIDE ON EXPRESS HOLDINGS Co., Ltd. Announces Possible Personal Info... | RIDE ON EXPRESS HOLDINGS Co., Ltd. — Notice of System Failure at Co... | 「銀のさら」など公式サイト・アプリにサイバー攻撃、個人情報最大約650万件漏えいの可能性｜インシデントレーダー | Customer Data Breach Suspected at Sushi Delivery Operator Nippon.com | ライドオンエクスプレスホールディングス(6082) 当社連結子会社におけるシステム障害発生に関するお知らせ(第2報)及びサイバー攻撃…...