Burger King Japan Confirms Data Breach Exposing 11.18M User Records
Burger King Japan confirmed unauthorized access exposed 11.18 million app member records with names and contact details.
Burger King Japan confirmed that an outside party accessed the system managing official-app member data between October 2 and October 7, 2026, exposing about 11.18 million records. Exposed fields include member IDs, names, email addresses, phone numbers, dates of birth, gender, prefecture, and flags for mobile ordering and email verification. The company said it does not hold credit card numbers and has not confirmed a password leak, ransomware, or payment-system compromise. It blocked the access, notified Japan’s Personal Information Protection Commission, and is emailing members while the entry method remains under investigation.
- Unauthorized access ran from October 2 to October 7, 2026; the leak was confirmed October 13.
- About 11.18 million app member records were exposed, not a verified count of unique people.
- Data included names, emails, phone numbers, birth dates, gender, and prefecture.
- Credit card numbers were not stored; password exposure has not been confirmed.
- Initial access method is still under investigation; no ransomware or card compromise was established.
Full article701 words · extracted from cybersecuritynews.com · click to collapse
Burger King Japan has confirmed a data breach that exposed about 11.18 million records linked to members of its official app. BK Japan, which operates the chain in Japan, said an outside party gained unauthorized access to the system used to manage app member information.
The company disclosed the incident on October 15, 2026. According to its notice, the unauthorized access occurred between October 2 and October 7, and the company confirmed the information leak on October 13. The disclosure concerns member records, not a verified count of unique people.
The exposed information includes member IDs, email addresses, registration type, prefecture, gender, dates of birth, full names in kanji and kana, and phone numbers. The affected fields also include whether members used mobile ordering and whether their email addresses had been verified.
The mobile ordering field describes whether someone used that feature. It should not be presented as evidence that detailed purchase histories or individual order contents were exposed. Likewise, a prefecture identifies a region within Japan, rather than necessarily revealing a complete home address.
BK Japan said it does not hold credit card numbers, so those details were not leaked in this incident. The company also said no leak of login passwords has been confirmed so far. That wording leaves the password finding subject to the ongoing investigation, rather than providing an unconditional guarantee.
How Burger King Responded
The company said it blocked the unauthorized access, formed a response team, and notified Japan’s Personal Information Protection Commission. It is also emailing affected members about the incident.
Outside experts are helping investigate the cause and how the attacker first entered the system. BK Japan has not publicly identified an exploited vulnerability or confirmed whether stolen credentials were involved. The disclosed details do not establish ransomware, a payment system compromise, or a connection to another attack.
Reporting by Noticias SIN also cites the company’s plans to strengthen system security and monitoring while working with outside specialists. Those measures address future protection, but the investigation must still determine how the access occurred and which controls failed.
BK Japan said no secondary harm, including fraudulent use of the exposed information, has been confirmed. However, the combination of names, birth dates, phone numbers, and email addresses creates a clear risk of convincing phishing messages.
A scammer could use those details to make a fake Burger King refund, account check, or security alert appear genuine. Messages could direct users to a false login page or ask them to provide payment details. These are potential follow-up threats, not activity confirmed in this case.
The absence of confirmed misuse does not make leaked records harmless, especially when attackers can combine several personal details to make a message sound more believable to recipients.
Restaurant data breaches can expose personal information without exposing card numbers. Cyber Security News previously reported on a McDonald’s breach involving customer contact details in South Korea and Taiwan, while payment information was not included.
The publication also covered separate Burger King drive thru Assistant security flaws in 2025. That report concerned a different platform, and the available evidence does not connect those findings to the Japan app breach.
Affected members should treat unexpected emails, text messages, and calls claiming to represent Burger King with caution. Rather than following a message link, they should open the official app or type the company’s website address directly to check any account notice.
Members should not share passwords, payment details, or verification codes in response to unsolicited contact. Anyone who entered credentials on a suspicious page should change the affected password and replace it anywhere else it was reused.
For now, the key confirmed issue is the exposure of app member information. The initial access method and full technical cause remain under investigation. Future updates should clarify those gaps without confusing confirmed findings with possible risks.
An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.
Guru Baranhttps://cybersecuritynews.com
Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments.