Breaches and incidents
Yoshinoya Holdings (Yoshinoya, Hanamaru): ex-recruiting vendor ApplyNow breached, 5,366 applicants’ data kept after contract end leaked
Per ITmedia, Yoshinoya HD said 5,366 applicant records (4,998 Yoshinoya, 368 Hanamaru) from April 2022 to June 2024, 418 employee records and 418 recruiter...
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- Per ITmedia, Yoshinoya HD said 5,366 applicant records (4,998 Yoshinoya, 368 Hanamaru) from April 2022 to June 2024, 418 employee records and 418 recruiter accounts (incl. encrypted passwords) leaked from ApplyNow, a recruiting vendor whose contract ended in June 2024 but which still held the data.
- Root cause per ITmedia: a third party exploited a vulnerability in a data analysis tool and exported data between 9 Aug and 7 Sep 2026.
- No attacker named.
- ApplyNow blocked access and fixed the flaw; Yoshinoya learned on 28 Sep the data had not been deleted; affected people were emailed from 1 Oct and vendor management will be reviewed.