Yakult Website Data Breach Exposes 40,000 Records, Highlighting Food Industry Cybersecurity Risk

Yakult Honsha, the Japanese probiotic drinks group, has confirmed that personal information on about 40,000 people leaked after unauthorized access to its website. It is the latest in a series of cyber incidents to hit food and beverage manufacturers.

The company detected the intrusion on 26 October 2026 and suspended some website functions while it investigated. In a statement issued on 30 October, Yakult said it had “confirmed that personal information of approximately 40,000 individuals has been leaked.”

Who and what was affected

According to the company’s disclosure and reporting by Just Food, the breach covers three main groups:

• Consumers who submitted enquiries through Yakult’s website.
• Registered members of “Tanoshii Kyushoku” (Enjoyable School Lunches), Yakult’s school-lunch information portal.
• Media contacts.

The exposed data includes names, addresses, phone numbers, email addresses, age groups, occupations and the text of enquiries. For school-lunch portal members, encrypted passwords and product preferences were also accessed. The full names of Yakult employees who handled enquiries were exposed as well.

Yakult said credit card and bank account details are not stored on the website. The company has filed an initial report with Japan’s Personal Information Protection Commission and consulted the police. It has not identified any secondary harm so far, but it warned consumers to be wary of suspicious emails and calls, stressing that it will “never ask you for your password, account number, or credit card number.”

Not the group’s first incident

It is not Yakult’s first cyber incident. In December 2023, its Australian subsidiary suffered a breach in which employee files were leaked on the dark web, Just Food noted. Other Japanese food and drink companies have also been hit recently, including frozen-food group Nichirei in July and Asahi Group Holdings in September 2025.

The incident comes as Yakult is under financial pressure. For the fiscal year ended 31 March, net sales fell 2.7% to ¥486.43 billion and operating profit fell 18.4% to ¥45.19 billion. The company forecasts net sales of ¥527 billion for the year ending 31 March 2027.

Consumer-facing web platforms are a growing attack surface

The Yakult breach did not hit production or logistics systems. It still shows how much consumer data food manufacturers now hold in their direct-to-consumer and marketing platforms, including enquiry forms, membership portals, recipe sites and loyalty programs. These systems are often run separately from core IT, sometimes by agencies or third-party vendors, and may get less security investment than ERP or plant control networks.

Attacks on operational systems have caused more visible disruption across the sector. Food Tech Insider has previously covered a cyber incident at Ahold Delhaize that took grocery e-commerce services offline, and a cyberattack affecting Danfoss refrigeration systems that disrupted cold-chain operations in French supermarkets. Together these incidents show that food companies face cyber risk at every layer, from customer-facing websites to the equipment that keeps products cold.

Practical lessons for food and beverage brands

• Map consumer data: list every website, campaign microsite and portal that collects personal data, including legacy and agency-run properties.
• Minimize retention: enquiry text and contact details kept for years increase exposure when a breach happens.
• Harden credentials: encrypting or hashing passwords limits the damage, but member portals still need multi-factor options and regular security testing.
• Prepare the response: clear regulator notification, police liaison and consumer warnings, as Yakult issued, help limit secondary fraud such as phishing.