Pizza Hut: unauthorized access to the online ordering payment API

On October 19 a third party accessed the payment API (the interface that exchanges payment data between systems) of the online ordering service in Japan without authorization and retrieved part of the data in a database holding customer information. The confirmed leaked data are customer IDs, email addresses, phone numbers, records about deleted customer data, session login tokens and transaction records; card data is not included. According to news reports, up to about 4.48 million records may be affected. The company blocked the attacking IP addresses and addressed the vulnerability; the cause and scope were under investigation.