Burger King Japan Confirms Exposure of 11.18 Million App Records

Burger King Japan says Oct. 2–7 access exposed about 11.18 million official-app member records, without stored card data.

Burger King Japan confirmed that an outside party accessed the system managing official-app member data between October 2 and October 7, 2026; the leak was confirmed on October 13 and announced on October 15. All three reports put the exposure at about 11.18 million records, though Cyber Security News stresses this is not a verified count of unique people while Security Affairs describes 11.18 million members. Shared fields include names, email addresses, phone numbers, dates of birth, and gender; member IDs, prefecture, and account or verification flags are also reported, while only BleepingComputer cites order history. The company said it does not store credit card numbers and has not confirmed password exposure, ransomware, payment-system compromise, or fraud; BleepingComputer reported no evidence that credentials were accessed. Burger King Japan blocked the access, formed an incident team, engaged outside specialists, notified Japan's Personal Information Protection Commission, is emailing members, and warned of impersonation phishing, while the entry method remains under investigation.

• Unauthorized access to Burger King Japan's official-app membership system ran from October 2 to October 7, 2026; the leak was confirmed October 13 and announced October 15.
• About 11.18 million app member records were exposed; sources disagree on whether that equals unique people or members.
• Reported fields include member IDs, names, emails, phone numbers, dates of birth, gender, prefecture, and account or verification flags; only BleepingComputer cites order history.
• Credit card numbers were not stored; password or credential exposure has not been confirmed, and BleepingComputer said no evidence credentials were accessed.
• No ransomware, payment-system compromise, or fraud has been confirmed.
• The company blocked the access, formed an incident team, engaged outside specialists, notified Japan's Personal Information Protection Commission, is emailing members, and warned of impersonation phishing.
• The initial access method remains under investigation.