Sarasota US Topco, Inc., which does business as Sarku Japan and is based in Phoenix, Arizona, has reported a data breach that exposed sensitive personal and financial information. This page summarizes what is publicly known from the Texas Attorney General’s breach report.
Sarku Japan’s Data Breach Investigation
On October 28, 2026, the Texas Attorney General’s Office published a data security breach report filed by Sarasota US Topco, Inc., which does business as Sarku Japan. The company is listed with an address in Phoenix, Arizona, and the Sarku Japan name is used by a restaurant group. The report states that 687 Texans were affected and that notice was provided to them by U.S. Mail.
The report lists a broad set of information: names, Social Security numbers, driver’s license numbers, other government-issued ID numbers, financial information such as an account number or a credit or debit card number, and an additional category labeled other that the filing does not define. The filing does not say whether the people affected are customers, employees, job applicants or others.
The figure of 687 applies only to Texas residents. Companies with locations in many states often report separately to each state, and a total across all states can be larger than any one state’s number. The total number of people affected has not been published.
Separately, a template notice letter filed under the Sarku Japan name with Massachusetts regulators offers 24 months of identity monitoring through Kroll, along with general guidance on fraud alerts and credit freezes. That letter contains blank merge fields and does not state when any incident occurred or what happened, and it has not been confirmed that it describes the same event as the Texas report.
The cause has not been disclosed. Nothing in the Texas report indicates whether an outside attacker, a vendor or an internal error was responsible. A person who received a letter should rely on it for those details, including whether credit monitoring is being offered to them.
A Social Security number combined with a driver’s license or other government ID number is one of the most dangerous combinations for identity theft, because those details are enough to open accounts, file false tax returns or pass identity checks in someone’s name. Unlike a card number, a Social Security number cannot easily be changed, so the risk can last for years. State breach laws generally require businesses to protect this kind of information and to notify affected people without unreasonable delay, and attorneys are looking into whether reasonable steps were taken and whether the notice met the standards that apply.
When Did This Breach Occur?
The Texas report gives the date it was published, October 28, 2026, but does not state when the incident happened or when it was discovered. No timeline showing when unauthorized access began, was detected or ended has been published, so the timing of the underlying event should be treated as unknown for now.
What Information Was Breached?
The Texas report lists names, Social Security numbers, driver’s license numbers, other government-issued ID numbers, financial information such as account or card numbers, and an undefined other category. Not every person will have had every category involved, so your notice letter is the best guide to what applies to you.
What You Can Do
If you received a notice related to Sarku Japan or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- If the notice offers identity monitoring, enroll before the deadline it gives, and consider asking your bank or card issuer about replacing any card that may have been exposed.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Sarku Japan
If you received a notice from Sarku Japan, or you believe your Social Security number, ID or financial information was involved, you may have legal options for holding the company accountable for how it protected your sensitive data.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
