The sushi list was a ceiling

They mailed the ceiling because the disk would not come back.

Ride On Express Holdings said today that the server holding Gino no Sara, Kamatora, and Sushi Joto official-site and app registrations was reached, and that personal information may have left. The ceiling is about 6.5 million records. That number, the company writes, is not a confirmed leak. It has not found a clear trace, and it has not fixed the fact or the range. It is publishing anyway. The field list: name, address, phone, email, gender, date of birth, a password hash, order history, and the Deli Point member ID. Family names and birthdays if a customer typed them. A delivery name, address, and phone if those were typed. Cards are not in the company. Demae-can, Uber Eats, and phone-only orders are out of this file.

The timeline in the notice is the reason they counted before they knew. From 5 October they were looking at third-party access on servers they use. On the morning of the 7th some of those servers failed. The operator told them it was ransomware, and that the data they had left there would be hard to take out or restore. Ride On stopped the systems the same day. Site and app orders are still down. Phone, counter, and the platforms that were never on that disk are still taking orders.

What 6.5 million will be asked to cover

It will be briefed as “the sushi chain lost six million cards.” The company does not hold the card. It will be briefed as a confirmed dump. The notice is a maybe they chose to send because the host could not hand the disk back. A hash next to an order history is enough for a call that already knows last Tuesday’s delivery. It is not a finding that the restaurant till was reached.

If you only ever ordered by phone, you are not in this list. If you typed a family birthday into the app, that birthday is. Wait for their mail. Do not open a reset that arrives first. The official site is not taking orders. A site that asks you to log in and “confirm the leak” is someone else.

They published a ceiling because restore failed. Treat the fields they listed as exposed until they subtract. Do not treat the restaurant as the server.