Notice and Apology Regarding the Leak of Customer Email Addresses Due to Unauthorized Access to an External Email Delivery Service

Unauthorized third-party access occurred at an email delivery service provided by a service provider (arara inc.) used by Kewpie Corporation, Aohata Corporation, Deria Foods Co., Ltd., Salad Club, Inc., and Tou Kewpie Co., Ltd.

As a result, it was found that 125,788 email addresses of certain customers who applied for campaigns across these five companies or used Kewpie Corporation's "Contact Us" form between September 12, 2023, and October 31, 2026, were leaked externally.

We deeply apologize for the significant concern and inconvenience caused to our customers and other related parties. Below is a report of the facts confirmed to date and our future response.

1.Timeline

• ・Wednesday, October 28:Received notification from arara inc. that unauthorized third-party access had occurred, and immediately requested an urgent investigation into any impact on Kewpie Group companies.
• ・Monday, November 2:Received a report from arara inc. stating that an investigation by their technical department found no traces of data leakage concerning the Kewpie Group.
• ・Sunday, November 8:Received a report from arara inc. stating that, following a detailed investigation, it was confirmed that the email addresses of customers to whom automated reply emails were sent within the Kewpie Group's environment had been leaked externally.

2.Scope of Impact

• ・Affected Customers:Customers who received any of the following automated reply emails from the five target companies (Kewpie Corporation, Aohata Corporation, Deria Foods Co., Ltd., Salad Club, Inc., and Tou Kewpie Co., Ltd.) between September 12, 2023, and October 31, 2026:
• 1. Campaign application completion emails
• 2. Online survey completion emails
• 3. kewpie ID point exchange confirmation emails
• 4. Product sample request completion emails
• 5. Customer Service Office inquiry receipt confirmation emails
• ・Number of Affected Records:125,788 (total across the five companies)
• ・Leaked Information:Email addresses only

3.Method of Notification to Affected Customers

Individual notification emails have been sent to affected customers starting at 10:00 AM on Thursday, November 12.

4.Request to Our Customers

There is a concern that the leaked email addresses may be misused to send suspicious emails (such as phishing scams) impersonating legitimate companies, including the five target companies. If you receive an email from an unfamiliar sender or an email containing suspicious links or attachments, please do not click any links, open attachments, or enter personal information, and delete the email immediately.

5.Future Response

The delivery of automated reply emails from "Campaign Applications" and "Contact Us" forms is currently suspended. This suspension will remain in place until security measures by the service provider (arara inc.) are completed and safety is objectively verified. We will further strengthen our service provider selection criteria and audit our service providers' information security management systems more rigorously to prevent recurrence. If any new facts requiring disclosure emerge in the future, we will promptly announce them on each company's website, etc.

6.Contact Information

Kewpie Group Customer Response Desk

Contact Form: https://www.kewpie.co.jp/enquetes/customer/e62e9c5721cb6/