Burger King Japan breach exposes data for 11.18 million app members
The fast-food chain confirmed an outsider accessed its member management system, leaking personal details for millions of users in Japan.
Key points
- An unauthorised party accessed the system managing Burger King Japan app members between 2 October and 7 October 2026.
- Approximately 11.18 million records were exposed, including names, phone numbers, email addresses and dates of birth.
- Credit card numbers were not held by the company, and no password leaks have been confirmed so far.
Burger King Japan has confirmed a significant data breach affecting its official mobile application. The company disclosed the incident on 15 October 2026, stating that an outside party gained unauthorised access to the system used to manage member information. This exposure involves approximately 11.18 million records linked to app users across Japan.
What personal information was compromised?
The leaked data includes sensitive personal identifiers such as full names in both kanji and kana scripts, email addresses, phone numbers and dates of birth. Members’ prefectures, which indicate their region within Japan, were also exposed. Additionally, the breach revealed registration types, member IDs and whether users had verified their email addresses.
The breach also included data indicating whether members used the mobile ordering feature. However, this field only confirms the use of the service, not specific purchase histories or individual order contents. It does not reveal detailed transaction records or the specific items ordered by customers.
Were financial details or passwords stolen?
Burger King Japan stated that it does not store credit card numbers on its systems, meaning payment details were not part of this leak. The company also reported that no leak of login passwords has been confirmed at this stage. This wording suggests that password security remains under investigation rather than being definitively ruled out.
How did the attackers gain access?
The unauthorised access occurred between 2 October and 7 October 2026, with the company confirming the information leak on 13 October. Outside experts are currently assisting in the investigation to determine the cause and how the attacker initially entered the system. The company has not yet identified a specific exploited vulnerability or confirmed if stolen credentials were involved.
What steps has the company taken?
Burger King Japan said it blocked the unauthorised access and formed a dedicated response team to handle the incident. The company notified Japan’s Personal Information Protection Commission and is emailing affected members directly about the breach. It plans to strengthen system security and monitoring while working with outside specialists to address future protection needs.
What affected people can do
Users should review their recent bank and credit card statements for any unusual activity, even though payment details were not stored. Check email inboxes for official notifications from Burger King Japan regarding this breach. Be wary of follow-up messages claiming to offer compensation or password resets, as attackers often exploit such incidents for phishing. Change passwords for any accounts that share the same credentials as the app.
What to do and how to stay safe: Burger King Japan
- Monitor financial accounts for unauthorised transactions, as identity theft can occur even without direct payment data exposure.
- Enable multi-factor authentication on the Burger King app and any other online accounts using the same email or password.
- Verify the authenticity of any communications from the company by checking official channels rather than clicking links in unexpected emails.
- Consider placing a fraud alert with credit reporting agencies if sensitive personal data like dates of birth were exposed.
Step-by-step guide: Identity Theft Protection: Answers to Critical Security Questions
General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did Burger King Japan lose customer credit card information?
No, the company stated it does not hold credit card numbers, so those details were not leaked in this incident.
When did the unauthorised access to the system occur?
The unauthorised access occurred between 2 October and 7 October 2026, according to the company’s disclosure.
Has the company confirmed if passwords were stolen?
No, Burger King Japan stated that no leak of login passwords has been confirmed so far, leaving the matter under investigation.
