# Burger King Japan Breach Exposes 11 Million Customer Records

> Burger King Japan publicly disclosed a data breach affecting approximately 11.18 million customer records from its smartphone app's membership system in October 2026.

By PrimaryBrief newsroom · Published 2026-10-22T06:24:18.574120Z
Canonical: https://primarybrief.com/article/burger-king-japan-breach-exposes-11-million-customer-records-b15224a2

On October 15, 2026, Burger King Japan (BK Japan) publicly disclosed a significant data breach, affecting approximately 11.18 million customer records from its official smartphone application's membership system [1][6][7][8][9][10][11][12][13][14][15][16][17][18][19]. The incident was identified on October 13, 2026, following unauthorized access to the company's member information management system that occurred between October 2 and October 7, 2026 [1][7][8][13][14][15][16][17][18][19].

This breach exposes a vast amount of personal information, which increases the risk of targeted phishing and social engineering attacks for millions of individuals [1][6][9][15][16][18][19]. Cybersecurity experts warn that even without credit card details or confirmed passwords, the stolen data is sufficient for malicious actors to craft convincing scams [1][15][16].

## What the records show

The compromised data is extensive, including names in both Kanji and Kana, email addresses, phone numbers, dates of birth, gender, member IDs, and prefectures of residence [1][13][14][15][16][17][18][19]. Registration types, email verification statuses, and flags indicating whether members had used mobile ordering were also exposed [1][13][15][16][18][19]. Burger King Japan confirmed that the affected system did not store credit card numbers [1][11][13][15][16][17][18][19]. The company also stated that investigators found no confirmed evidence that login passwords were exposed, though the investigation into this aspect is ongoing [1][13][15][16][17][18]. Muhammad Yahya Patel, vCISO and cybersecurity adviser for EMEA at Huntress, stated, “A loyalty app isn't just a marketing tool. It's a database of personal information that someone will eventually try to steal,” warning that the exposed information could help attackers craft convincing phishing attacks [16].

## The timeline

Unauthorized access to Burger King Japan's member information management system occurred between October 2 and October 7, 2026 [1][13][14][15][16][17][18][19]. The company identified the incident on October 13, 2026, and publicly disclosed the data breach on October 15, 2026 [1][7][8][13][14][15][16][17][18][19].

## What changed and for whom

Upon detecting the unauthorized access, Burger King Japan immediately blocked the suspected source [1][13][14][16][19]. The company reported the breach to Japan's Personal Information Protection Commission (PPC) and enlisted external cybersecurity specialists to assist in investigating the incident and implementing countermeasures [1][13][14][16][18][19]. For customers, this means an increased need for vigilance against potential scams [1][6][9][15][16][18][19].

## What the subject has said publicly

Burger King Japan issued an official notice expressing apologies to its customers [1]. The company stated, "We sincerely apologize for the great inconvenience and concern this situation has caused to our customers and all others involved" [1][14]. The company also issued strong warnings, advising customers to be vigilant against suspicious emails, SMS messages, and phone calls impersonating Burger King Japan [1][18][19]. Customers were cautioned against clicking unverified links, opening attachments, or entering membership information or passwords in response to suspicious communications [1][18].

## What we could not confirm

As of the reporting date, Burger King Japan has not confirmed any cases of fraudulent use or secondary damage directly resulting from this incident [1][11][13][14][16][17][19]. The initial access method and the specific vulnerability exploited by attackers remain undetermined [1][13][16][19]. While the company has stated no login passwords were confirmed to be exposed, this finding remains provisional as the investigation continues [1][13][15][16][17].

## Evidence cited
1. Burger King Japan data breach exposes 11 million customer records (bleepingcomputer.com) — https://www.bleepingcomputer.com/news/security/burger-king-japan-data-breach-exposes-11-million-customer-records/
2. Meta fined $25bn for 'lies' over user data privacy (www.bbc.co.uk) — https://www.bbc.co.uk/news/articles/cqdr8zxrr3dxo?at_medium=RSS&at_campaign=rss
3. China’s economy grows faster than forecast after AI boom boosts exports (www.theguardian.com) — https://www.theguardian.com/world/2026/oct/19/china-economy-grows-faster-than-forecast-after-ai-boom-boosted-exports
4. Brazil’s Bolsonaro challenges Lula to expand release of personal records (www.aljazeera.com) — https://www.aljazeera.com/news/2026/10/22/brazils-bolsonaro-challenges-lula-to-expand-release-of-personal-records?traffic_source=rss
5. The A.I. Data Center Backlash Has Reached a Quiet Corner of Rural England (www.nytimes.com) — https://www.nytimes.com/2026/10/20/world/europe/ai-datacenter-devon-uk-backlash.html
6. Burger King Japan Confirms Data Breach Exposing 11.18 Million Customer Records (esecurityplanet.com) — https://www.esecurityplanet.com/news/burger-king-japan-data-breach/
7. Burger King Japan Data Breach Exposes 11.18 Million Records (safestate.com) — https://www.safestate.com/blog/burger-king-japan-data-breach/
8. Burger King Japan App Breach Exposes 11.18M Records [2026] (shattered.io) — https://shattered.io/articles/burger-king-japan-app-breach-exposes-11-18m-records-2026/
9. Burger King Japan Data Breach Exposes 11M Customer Records: Risks Phishing and Social Engineering (rescanada.com) — https://rescanada.com/burger-king-japan-data-breach-exposes-11m-customer-records-risks-phishing-and-social-engineering/
10. Burger King Japan Data Breach Impacted 11 Million Customers (securityaffairs.com) — https://securityaffairs.com/165576/breaking-news/burger-king-japan-data-breach.html
11. Burger King Japan hit by huge data breach (techradar.com) — https://www.techradar.com/news/burger-king-japan-hit-by-huge-data-breach
12. Burger King Japan Data Breach Exposes 11 Million Customer Records (cybersecuritynews.com) — https://cybersecuritynews.com/burger-king-japan-data-breach/
13. Burger King Japan Data Breach Leaked 11M Records (cyberinsider.com) — https://cyberinsider.com/burger-king-japan-data-breach-leaked-11m-records/
14. Burger King Japan data breach exposes 11 million customers' records (cybernews.com) — https://cybernews.com/news/burger-king-japan-data-breach/
15. Burger King Japan Data Breach Exposes 11.18M Records From App (gadgetreview.com) — https://gadgetreview.com/burger-king-japan-data-breach/
16. Burger King Japan Confirms Data Breach Exposing 11.18 Million Customer Records (esecurityplanet.com) — https://esecurityplanet.com/news/burger-king-japan-data-breach/
17. Burger King Japan Data Breach: 12 Million Records Exposed (hackread.com) — https://hackread.com/burger-king-japan-data-breach-emails-birthdates/
18. Burger King Japan announces 11.18 million customer data breach (verdictfoodservice.com) — https://verdictfoodservice.com/news/burger-king-japan-data-breach-2/
19. Burger King Japan Data Breach Exposes 11.18 Million Customer Records - Captain Compliance (captaincompliance.com) — https://captaincompliance.com/news/burger-king-japan-data-breach/
20. Burger King Japan reports data breach affecting 11.18 mil customers (japantoday.com) — https://japantoday.com/category/business/burger-king-japan-reports-data-breach-affecting-11.18-mil-customers
21. Global Ransomware Attacks Trend Report: H1 2026 (forescout.com) — https://forescout.com/resources/global-ransomware-attacks-trend-report/
22. Japanese Cybersecurity Trends Q1 2026: Rise of Russian and Chinese Threat Actors - CybelAngel (cybelangel.com) — https://www.cybelangel.com/blog/japanese-cybersecurity-trends-q1-2026-rise-of-russian-and-chinese-threat-actors/
23. Japan Facing Dense Wave of Breach Disclosures - SOCRadar Dark Web News (socradar.io) — https://socradar.io/japan-facing-dense-wave-of-breach-disclosures-socradar-dark-web-news/
24. Trend Micro Issues Threat Advisory for Organizations in Japan - Trend Micro (trendmicro.com) — https://www.trendmicro.com/en_us/about/newsroom/pr/2026/trend-micro-issues-threat-advisory-for-organizations-in-japan.html
25. Understanding Japan's Cyber Threats in 2026: On The Front Lines of Supply Chain Attacks and Geopolitical Risks - Group-IB (group-ib.com) — https://www.group-ib.com/resources/webinars/japan-threats-2026/
26. Threat Intelligence Bulletin – October 19th, 2026 - Check Point Software (checkpoint.com) — https://www.checkpoint.com/press/2026/threat-intelligence-bulletin-october-19th-2026/