Subway Japan data breach
Subway Japan announced a data breach on Nov 2, 2026 involving up to 1.1 million records (duplicates possible), exposing email addresses and dates of birth. It happened through a vendor (Arara (email delivery service)). No settlement or compensation has been announced.
Was I affected?
People subscribed to Subway Japan's email newsletter, including former Subway Club Card users whose old card details were still in the email system.
| Announced | Nov 2, 2026 |
|---|---|
| When it happened | Intrusion at email vendor Arara; Subway Japan first said on October 29, 2026 that its data was not involved, then confirmed the leak on November 5 |
| Country | Japan |
| Records exposed (may include duplicates) | 1.1 million |
| Data exposed | Email addresses, Dates of birth and Other details |
| Through a vendor | Arara (email delivery service) |
| Status | Confirmed by the company or a regulator filing |
What happened
WATAMI Fast Casual Management, which runs Subway's sandwich shops in Japan, said on November 5, 2026 that up to 1,107,494 customer records leaked after an outsider broke into the external system it used to send its email newsletter, run by Arara. Besides email addresses, the data includes dates of birth, gender, occupation, area of residence and favorite stores, plus card numbers, balances at the time and usage history for the old Subway Club Card, a prepaid card discontinued on August 31, 2023. The company holds no credit card data. It had said on October 29 that its customers were not affected, before warning of a possible leak on November 2 and confirming it in its third notice.
What should I do?
- Be wary of emails claiming to come from Subway or a card company, and delete them without opening links or entering personal details.
- Check coupons in the official Subway Japan app or site rather than through email links.
- Old Subway Club Card balances can no longer be used, so treat any message offering to refund or restore them as a scam.
How Korea fines a breach this size
For comparison, Korea's privacy regulator fined Dior Korea ₩12.2 billion (about US$8M) in February 2026 over a breach of 1.95 million people. Korean law fines the security failure itself, not only misuse of the data.
Check the other services you use →
Sources
- 【重要】外部メール配信システムへの不正アクセスに伴う個人情報等の流出に関するお詫びとご報告（第3報） (Apology and report on the leak of personal data caused by unauthorized access at an external email delivery system (third notice)) · Subway Japan (in Japanese) · official
- 【重要】外部メールマガジン配信システムへの不正アクセスに関するお詫びとご報告（第2報） (Apology and report on unauthorized access at an external newsletter delivery system (second notice)) · Subway Japan (in Japanese) · official
- サブウェイ ライフ 個人情報漏えいか アララ不正アクセス影響 · NHK (in Japanese) · news