Burger King Breach Exposes 11 Million Records in Japan

The Burger King breach in Japan has exposed 11.18 million customer records after attackers accessed a system containing smartphone app membership data. The compromised information included personal details, contact information and order histories.

Burger King Japan confirmed the leak following an investigation that concluded on October 13. According to the company, unauthorized access occurred between October 2 and October 7, 2026.

Attackers Accessed App Members’ Personal Information

The affected system held information belonging to users of Burger King Japan’s official smartphone app. Exposed records included names, birth dates, gender, email addresses, telephone numbers and order histories.

However, the compromised server did not contain customer credit card numbers. The company also said investigators found no evidence that attackers accessed login credentials.

The reported total refers to customer records. It does not necessarily establish that the incident affected 11.18 million different people.

Company Blocks Access and Investigates Entry Point

Burger King Japan said it blocked access from the identified source immediately after discovering the intrusion. It subsequently confirmed that the unauthorized activity had resulted in a leak of member information.

The company disclosed the findings in an October 15 notice and apologized to customers. It also reported the incident to Japan’s Personal Information Protection Commission.

Meanwhile, external cybersecurity specialists are helping investigate how the attackers entered the system. The company has not yet identified the initial access method publicly.

At the time of its announcement, Burger King Japan said it had confirmed no resulting fraudulent use or other secondary harm.

Customers Warned About Impersonation Attempts

Following the Burger King breach, the company urged customers to remain alert for suspicious emails, text messages and telephone calls.

In particular, customers should treat unexpected communications claiming to represent Burger King Japan with caution. The company advised against opening suspicious attachments, following unfamiliar links or providing membership details and passwords.

The exposed contact details and purchase histories could help criminals make impersonation attempts appear convincing. However, the company has not confirmed that such activity has occurred.

Incident Adds to Cybersecurity Concerns in Japan

The disclosure follows cybersecurity incidents involving several major Japanese businesses, including Nikkei, IDC Frontier, Keio and Times Car.

Researcher Yutaka Sejiyama has recorded 119 incidents involving personal information theft or exposure in Japan this year. His findings highlight attackers’ efforts to identify weaknesses in websites and application programming interfaces.

These include access-control failures, configuration errors, authentication weaknesses and known software vulnerabilities. However, investigators have not established whether any of those methods caused the Burger King Japan intrusion.