Attorneys at Almeida Law Group are investigating whether a class action lawsuit can be filed on behalf of individuals affected by a possible Sarku Japan data breach. According to dark web monitoring sources, a hacker group calling itself thegentlemen claimed responsibility for a cyberattack on Sarku Japan in a post first observed in September 2026, alleging it had gained access to internal company systems. As of this writing, Sarku Japan has not issued a public confirmation of the incident, and the exact scope of any exposed data remains unknown. If you believe you were affected, contact Almeida Law Group.
About Sarku Japan
Sarku Japan, whose legal entity name is SJ EUS Food Inc., is a privately held American-Canadian quick-service restaurant (QSR) chain specializing in Japanese cuisine, including teriyaki, sushi, and bento boxes. Founded in 1987 in Boston, Massachusetts, the company is headquartered in Markham, Ontario, Canada, and operates more than 240 locations, primarily in US mall food courts, with additional locations in South America. The specific types of customer or employee data that may have been involved in this 2026 incident have not been specified.
What Happened?
Sarku Japan was listed as a victim in a ransomware leak-site allegation reported by Ransomware.live on September 15th, 2026. The claim is attributed to The Gentlemen ransomware group. No independent corroborating source confirming a successful attack against Sarku Japan has been found, and Sarku Japan has not publicly acknowledged this incident. The claim should be treated as an unverified attacker-side allegation only.
Notably, the description posted by The Gentlemen on their leak site inaccurately characterizes Sarku Japan as a foreign car service network based in Chiba, Japan — a description that does not match the actual restaurant chain operating at sarkujapan.com. Researchers note this may indicate the threat actor confused the target with a different company, embellished the listing, or copied text from an unrelated source. The ZoomInfo URL included in the claim itself resolves to the restaurant chain, not a car company. No data types have been confirmed as part of this 2026 incident.
The Gentlemen is a Ransomware-as-a-Service (RaaS) operation that emerged in mid-2025, reportedly led by Russian-speaking operators using the aliases “hastalamuerte” and “zeta88.” The group previously operated as ArmCorp, an affiliate of the Qilin ransomware operation, before splitting off following a payment dispute in July 2025. The Gentlemen employs double-extortion tactics — encrypting victims’ systems while threatening to publish stolen data — and has claimed nearly 300 organizations across more than 66 countries. The group has been tracked by multiple cybersecurity firms, including Palo Alto Unit 42, Cybereason, Halcyon, and Blackpoint Cyber. HackNotice also flagged the Sarku Japan claim.
This is not Sarku Japan’s first brush with a data security incident. In a confirmed 2022 breach, an unauthorized third party accessed certain Sarku Japan systems between January 13th–14th and February 6th, 2022. The company discovered the breach on February 6th, 2022, and determined that names, addresses, dates of birth, and Social Security numbers of as many as 28,298 individuals were potentially compromised. Consumer notifications began on March 16th, 2022, with additional notices mailed around August 8th, 2022. The 2022 breach was reported to both the California and Maine Attorneys General, and law firms including Console and Associates, P.C. and Arnold Law Firm investigated the incident for potential claims. No confirmed class action litigation or settlement related to the current 2026 ransomware allegation has been found.
Key Facts at a Glance
- Company or Organization: Sarku Japan (SJ EUS Food Inc.)
- Industry: Restaurants / Quick-Service Restaurant (QSR) / Food Services
- Location: Headquartered in Markham, Ontario, Canada; 240+ US locations; also present in South America
- Incident type: Ransomware leak-site allegation (unverified dark-web claim by The Gentlemen)
- Prior breach: Confirmed 2022 breach affecting up to 28,298 individuals (names, addresses, dates of birth, Social Security numbers)
- Litigation status: Law firms investigated the 2022 breach for potential claims; no confirmed litigation related to the 2026 allegation
- Source: Ransomware.live – Victim: Sarku Japan; HackNotice – Sarku Japan; Palo Alto Unit 42 – The Gentlemen Ransomware; Halcyon – The Gentlemen Ransomware Group; JD Supra – Data Breach Alert: Sarku Japan (2022); Maine AG – Sarku Japan Notice of Data Event
What Should You Do?
If you are a Sarku Japan customer or employee and are concerned about your personal information, there are practical steps you can take now. Place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to make it harder for unauthorized parties to open accounts in your name. Monitor your financial accounts and credit reports regularly for suspicious activity, and obtain your free annual credit reports at AnnualCreditReport.com. If you were also affected by the confirmed 2022 breach, pay particular attention to any accounts or services tied to the personal information exposed in that incident, including your Social Security number. If you suspect your information has been misused, visit IdentityTheft.gov for step-by-step recovery guidance.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
