Burger King Japan breach exposes 11 million app user records

Burger King Japan disclosed on October 15, 2026, that unauthorized third-party access to the servers managing its smartphone app exposed personal data belonging to 11.18 million customers. The company said the access occurred between October 2 and October 7, and that the exposed data has reportedly been leaked online.

The compromised records include names, dates of birth, gender, email addresses, phone numbers, and order history tied to the official Burger King Japan app. The company said the affected server did not store credit card numbers and that it has found no evidence attackers accessed user account credentials or passwords. Burger King Japan has not confirmed any secondary damage, such as fraudulent account use, resulting from the leak.

According to the company, the breach was identified when it detected potential unauthorized third-party access to the app-member-information system, at which point it blocked the source of the access and launched an investigation with external cybersecurity experts. That investigation concluded on October 13, two days before the public disclosure. Burger King Japan has reported the incident to Japan's Personal Information Protection Commission, as required for breaches of this scale under Japanese data protection law, and has apologized to affected customers.

The company is warning customers to watch for phishing attempts that impersonate Burger King Japan using emails, SMS messages, or phone calls referencing the breach, cautioning against clicking links, opening attachments, or entering account credentials in response to any such contact — a standard risk once a trove of names, contact details, and purchase history is circulating, since that data is enough to make a phishing message look convincingly personalized.

The breach adds to what cybersecurity researchers describe as an unusually active year for attacks on major Japanese companies; one Macnica researcher cited in reporting on the incident has logged 119 separate incidents involving personal information theft or exposure in Japan so far in 2026, as first reported by BleepingComputer.