Burger King Japan Breach Exposes 11 Million Customer Records

On October 15, 2026, Burger King Japan (BK Japan) publicly disclosed a significant data breach, affecting approximately 11.18 million customer records from its official smartphone application's membership system[1][6][7][8][9][10][11][12][13][14][15][16][17][18][19]. The incident was identified on October 13, 2026, following unauthorized access to the company's member information management system that occurred between October 2 and October 7, 2026[1][7][8][13][14][15][16][17][18][19].

This breach exposes a vast amount of personal information, which increases the risk of targeted phishing and social engineering attacks for millions of individuals[1][6][9][15][16][18][19]. Cybersecurity experts warn that even without credit card details or confirmed passwords, the stolen data is sufficient for malicious actors to craft convincing scams[1][15][16].

What the records show

The compromised data is extensive, including names in both Kanji and Kana, email addresses, phone numbers, dates of birth, gender, member IDs, and prefectures of residence[1][13][14][15][16][17][18][19]. Registration types, email verification statuses, and flags indicating whether members had used mobile ordering were also exposed[1][13][15][16][18][19]. Burger King Japan confirmed that the affected system did not store credit card numbers[1][11][13][15][16][17][18][19]. The company also stated that investigators found no confirmed evidence that login passwords were exposed, though the investigation into this aspect is ongoing[1][13][15][16][17][18]. Muhammad Yahya Patel, vCISO and cybersecurity adviser for EMEA at Huntress, stated, “A loyalty app isn't just a marketing tool. It's a database of personal information that someone will eventually try to steal,” warning that the exposed information could help attackers craft convincing phishing attacks[16].

The timeline

Unauthorized access to Burger King Japan's member information management system occurred between October 2 and October 7, 2026[1][13][14][15][16][17][18][19]. The company identified the incident on October 13, 2026, and publicly disclosed the data breach on October 15, 2026[1][7][8][13][14][15][16][17][18][19].

What changed and for whom

Upon detecting the unauthorized access, Burger King Japan immediately blocked the suspected source[1][13][14][16][19]. The company reported the breach to Japan's Personal Information Protection Commission (PPC) and enlisted external cybersecurity specialists to assist in investigating the incident and implementing countermeasures[1][13][14][16][18][19]. For customers, this means an increased need for vigilance against potential scams[1][6][9][15][16][18][19].

What the subject has said publicly

Burger King Japan issued an official notice expressing apologies to its customers[1]. The company stated, "We sincerely apologize for the great inconvenience and concern this situation has caused to our customers and all others involved"[1][14]. The company also issued strong warnings, advising customers to be vigilant against suspicious emails, SMS messages, and phone calls impersonating Burger King Japan[1][18][19]. Customers were cautioned against clicking unverified links, opening attachments, or entering membership information or passwords in response to suspicious communications[1][18].

What we could not confirm

As of the reporting date, Burger King Japan has not confirmed any cases of fraudulent use or secondary damage directly resulting from this incident[1][11][13][14][16][17][19]. The initial access method and the specific vulnerability exploited by attackers remain undetermined[1][13][16][19]. While the company has stated no login passwords were confirmed to be exposed, this finding remains provisional as the investigation continues[1][13][15][16][17].