Mos Food Services data breach
Mos Food Services announced a data breach on Nov 4, 2026 involving up to 7.5 million records (duplicates possible), exposing email addresses. It happened through a vendor (Arara (email delivery service)). No settlement or compensation has been announced.
Was I affected?
Mos Burger's Mos WEB members whose details Mos passed to Arara for its emails.
| Announced | Nov 4, 2026 |
|---|---|
| When it happened | Intrusion at email vendor Arara (its repica service); Arara told Mos on November 4, 2026 that the data had been taken |
| Country | Japan |
| Records exposed (may include duplicates) | 7.5 million |
| Data exposed | Email addresses and Other details |
| Through a vendor | Arara (email delivery service) |
| Status | Confirmed by the company or a regulator filing |
What happened
Mos Food Services, which runs the Mos Burger chain, said on November 4, 2026 that 7,517,087 records of its Mos WEB members leaked after an outsider broke into repica, an email delivery service run by Arara that Mos used to send member emails. The leaked data includes email addresses, age, gender and prefecture of residence. Card and other payment data were not part of the leak, and Mos says it never asks customers to enter card details or passwords by email.
What should I do?
- Be wary of emails claiming to come from Mos Burger, Mos Food Services or Arara, and delete them without opening links or attachments.
- Don't enter personal details, passwords or card numbers on a page reached from an email offering coupons or campaigns.
- Check coupons and your member account in the official Mos app or site rather than through email links.
How Korea fines a breach this size
For comparison, Korea's privacy regulator fined Louis Vuitton Korea ₩21.4 billion (about US$14M) in February 2026 over a breach of 3.6 million people. Korean law fines the security failure itself, not only misuse of the data.
Check the other services you use →
Sources
- 委託先メール配信サービスへの不正アクセスによるお客様情報の流出に関するお詫びとお知らせ (Apology and notice about a customer data leak caused by unauthorized access at our email delivery contractor) · Mos Food Services (in Japanese) · official
- モスやワークマン、IIJmioも アララへの不正アクセスで顧客情報の流出発表相次ぐ · ITmedia NEWS (in Japanese) · news