Ride On Express says unauthorized access may have exposed about 6.5 million customers

Ride On Express Holdings has disclosed that unauthorized access to its servers may have put the personal information of roughly 6.5 million registered customers at risk.

The company said the data potentially exposed includes names, addresses, telephone numbers, email addresses, dates of birth and encrypted passwords linked to users of its Gin no Sara, Sushi Joto and Kamatora delivery services. Ride On Express told customers it does not retain credit card information and that payment card data was not compromised.

The firm also said it has suspended taking orders through its websites and mobile apps since last Wednesday while it investigates the incident, and that it publicly disclosed the breach on Tuesday.

The company’s disclosure did not list a confirmed number of accounts actually accessed; instead it reported an upper estimate of about 6.5 million registered customers whose personal data may have been exposed.

The affected fields cited in Ride On Express’s statement included basic identity and contact details and encrypted passwords for accounts on its official digital platforms. Ride On Express operates multiple branded delivery services in Japan, and the company named Gin no Sara, Sushi Joto and Kamatora as those whose users were affected.

The firm framed the incident as resulting from unauthorized server access and said it is investigating the scope of the intrusion while keeping order-taking on its online channels suspended.

Separately, Central Japan Railway (JR Central) reported that about 15,000 users of its e-commerce website may have had names, addresses and email addresses leaked following fraudulent access at IDC Frontier, a cloud services unit of SoftBank; JR Central said credit card information was not affected.

The finance-focused headline from BigGo Finance likewise reported that ordering remained suspended and that up to 6.5 million customer records may have been leaked at the Gin no Sara delivery chain.

Ride On Express’s statement gave the types of data potentially exposed and the brands affected but did not provide further details on how the unauthorized access occurred, whether specific accounts have been confirmed as accessed, or what remedial steps beyond suspending online orders the company had taken at the time of the disclosure.