Burger King Japan has confirmed a data breach that exposed about 11.18 million records linked to members of its official app. BK Japan, which operates the chain in Japan, said an outside party gained unauthorized access to the system used to manage app member information.
The company disclosed the incident on October 15, 2026. According to its notice, the unauthorized access occurred between October 2 and October 7, and the company confirmed the information leak on October 13. The disclosure concerns member records, not a verified count of unique people.
The exposed information includes member IDs, email addresses, registration type, prefecture, gender, dates of birth, full names in kanji and kana, and phone numbers. The affected fields also include whether members used mobile ordering and whether their email addresses had been verified.
The mobile ordering field describes whether someone used that feature. It should not be presented as evidence that detailed purchase histories or individual order contents were exposed. Likewise, a prefecture identifies a region within Japan, rather than necessarily revealing a complete home address.
BK Japan said it does not hold credit card numbers, so those details were not leaked in this incident. The company also said no leak of login passwords has been confirmed so far. That wording leaves the password finding subject to the ongoing investigation, rather than providing an unconditional guarantee.
How Burger King Responded
The company said it blocked the unauthorized access, formed a response team, and notified Japan’s Personal Information Protection Commission. It is also emailing affected members about the incident.
Outside experts are helping investigate the cause and how the attacker first entered the system. BK Japan has not publicly identified an exploited vulnerability or confirmed whether stolen credentials were involved. The disclosed details do not establish ransomware, a payment system compromise, or a connection to another attack.
Reporting by Noticias SIN also cites the company’s plans to strengthen system security and monitoring while working with outside specialists. Those measures address future protection, but the investigation must still determine how the access occurred and which controls failed.
BK Japan said no secondary harm, including fraudulent use of the exposed information, has been confirmed. However, the combination of names, birth dates, phone numbers, and email addresses creates a clear risk of convincing phishing messages.
A scammer could use those details to make a fake Burger King refund, account check, or security alert appear genuine. Messages could direct users to a false login page or ask them to provide payment details. These are potential follow-up threats, not activity confirmed in this case.
The absence of confirmed misuse does not make leaked records harmless, especially when attackers can combine several personal details to make a message sound more believable to recipients.
Restaurant data breaches can expose personal information without exposing card numbers. Cyber Security News previously reported on a McDonald’s breach involving customer contact details in South Korea and Taiwan, while payment information was not included.
The publication also covered separate Burger King drive thru Assistant security flaws in 2025. That report concerned a different platform, and the available evidence does not connect those findings to the Japan app breach.
Affected members should treat unexpected emails, text messages, and calls claiming to represent Burger King with caution. Rather than following a message link, they should open the official app or type the company’s website address directly to check any account notice.
Members should not share passwords, payment details, or verification codes in response to unsolicited contact. Anyone who entered credentials on a suspicious page should change the affected password and replace it anywhere else it was reused.
For now, the key confirmed issue is the exposure of app member information. The initial access method and full technical cause remain under investigation. Future updates should clarify those gaps without confusing confirmed findings with possible risks.
An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.
