Sarku Japan Data Breach: What Information Was Exposed?

Sarasota US Topco, Inc., doing business as Sarku Japan (“Sarku Japan”), has reported a data breach that may have exposed sensitive personal information belonging to customers and possibly employees. The incident was reported to the Texas Attorney General on October 28, 2026.

What Happened in the Sarku Japan Data Breach?

Sarku Japan is a Japanese quick-service restaurant chain that has served customers since 1987. It operates more than 240 locations, mostly in food courts in malls across the country.

According to the disclosure, Sarku Japan reported a data breach to the Texas Attorney General on October 28, 2026. Separately, dark web monitoring sources report that a ransomware group calling itself The Gentlemen claimed an attack on Sarku Japan in September 2026, saying it had gained access to internal company systems. It has not been confirmed whether that claim is connected to the data breach in the filing.

When the incident occurred, how it happened, and how many people are affected have not been publicly confirmed.

This is not Sarku Japan’s first reported incident. In 2022, the company disclosed a separate breach affecting as many as 28,298 people. The 2026 incident is a different event, so some people may receive more than one notice.

What Information Was Exposed?

According to the disclosure, the information involved is sensitive personal information belonging to customers and possibly employees. The specific data types have not been publicly confirmed. Information held by a restaurant chain can include names and contact details, payment information, and, for employees, details used for payroll and employment.

The information involved may vary by individual, and not everyone had the same information exposed. If you receive a notice, it should describe what applies to you.

What Should You Do After the Sarku Japan Data Breach?

If you received a notice from Sarku Japan, or believe your information may have been affected, consider taking these steps:

• Review your notice. Read it carefully, since it should describe what information of yours was involved, and keep a copy for your records.
• Enroll in any free services offered. If the notice includes credit monitoring or identity protection, sign up.
• Review your accounts. Check your bank and card statements for activity you don’t recognize, and report anything suspicious right away.
• Check your credit reports. You’re entitled to a free report each year from Equifax, Experian, and TransUnion.
• Consider a fraud alert or credit freeze. Both are free and make it harder for someone to open new accounts in your name.
• Update your passwords. Change passwords on any account tied to Sarku Japan, such as a rewards or employee account, and on any account where you reused it.
• Be cautious of unsolicited contact. Be wary of unexpected emails, texts, or calls that mention Sarku Japan or this breach and ask for personal or financial information.

Can You Take Legal Action After the Sarku Japan Data Breach?

If your personal information may have been exposed in the Sarku Japan data breach, you may have questions about your rights and potential legal options. Whether you can bring a claim depends on the circumstances of the incident and the harm you suffered.

Morgan & Morgan is investigating data breach incidents to help determine whether affected individuals may have legal options. See if you qualify for a case.