> JapanHacked_
[Investigating][Severity: Major][Credential abuse]

Denny's: forged credentials in its app migration may have exposed members' email addresses and birth dates

Forged credentials in the Denny's app migration step exposed some members' email addresses, birth dates and more; the count is under investigation.

Disclosed

2026-11-03

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. It found that a third party could forge credentials in the step that moves members from the old app to the new Denny's app, and reach some member accounts. [1]

  2. It revoked the abused credentials and filed a preliminary report with the Personal Information Protection Commission. [1]

  3. It revoked further credentials it had found. [1]

  4. It published its first report. [1]

Impact

App member codes, email addresses, birth dates, gender, prefecture, favorite store and children's birthdays may have been viewed. The app does not hold names, addresses, phone numbers, passwords or card data. [1]

So far only the logs from 7 October have been checked, and the number of affected accounts is still under investigation. [1] [2]

Timeline

  1. Detected 2026-10-30
  2. Disclosed 2026-11-03
  3. 4 days

Attack or cause

Method
[Credential abuse]
Impact
[Data leak]
Entry point
Unknown

Data exposed or at risk

[E-mail address][Date of birth][Gender][Member or customer ID]

Services hit

Organizations involved

  • [Breached][Major]Tokyo, ChiyodaAccommodation, food and drink

    Denny's Japan Co., Ltd.

    App member codes, email addresses, birth dates, gender, prefecture, favorite store and children's birthdays may have been viewed; the count is under investigation.

Sources

  1. [1][Official]【重要】デニーズアプリへの不正アクセスに関するお詫びとお知らせ（第一報）Denny's Japan · 2026-11-03
  2. [2][News]デニーズ 旧アプリ利用者の個人情報漏えいか 不正アクセス受けNHK · 2026-11-04 13:24