Burger King Japan app breach exposes 11.18M customer records
Burger King Japan has disclosed a data breach in which attackers accessed a server holding 11.18 million customer records, according to BleepingComputer. The company says the data came from the system that manages members of its official smartphone app and was leaked online. Card numbers were not stored on the server, but names, contact details and order history were.
What we know
BleepingComputer reports that Burger King Japan published a press release on Thursday after finishing a follow-up investigation on October 13. The company says it first identified potential unauthorized third-party access to the member information system and then investigated.
- Unauthorized access occurred between October 2 and October 7, 2026, according to the company.
- The company determined on October 13, 2026 that member information had leaked.
- Burger King Japan says it blocked access from the source as soon as it became aware.
- The breach has been reported to Japan’s Personal Information Protection Commission (PPC).
- External cybersecurity experts are helping to work out how the attackers got in.
The company has apologized to affected customers. It also says it has not confirmed any secondary damage, such as fraudulent use of the data, so far.
Who is affected
The server held records for users of the Burger King Japan app. The exposed fields reported are:
- Names
- Dates of birth
- Gender
- Email addresses
- Phone numbers
- Order history
Burger King Japan says the compromised server did not store credit card numbers, and that it found no evidence the attackers accessed user credentials. Anyone with an account in the Japanese app should treat their profile data as exposed.
What has not been confirmed
- How the attackers gained access to the server has not been disclosed; the investigation is ongoing.
- The source article does not name the attackers or say whether a ransom or sale was involved.
- Where the data was leaked online, and how widely it is circulating, has not been disclosed.
- The finding that credentials were not accessed reflects the company’s investigation so far, not an independent verification.
Why this matters
Analysis: a combination of real names, birth dates, phone numbers, email addresses and order history is well suited to convincing phishing and phone scams. Attackers can reference genuine purchases to make a message look legitimate. The risk is highest for people in Japan, but any organization whose staff use the app should expect lure messages that impersonate the brand.
BleepingComputer also notes this incident follows a series of attacks on Japanese companies this year, and cites a Macnica researcher who has logged 119 incidents involving personal information theft or exposure in 2026. That context suggests attackers are actively targeting weaknesses in web and API access control, configuration and authentication.
What to do
For affected customers:
- Treat unexpected emails, SMS messages and phone calls that claim to come from Burger King Japan as suspicious, as the company itself warns.
- Do not click links, open attachments or enter member information or passwords in response to such messages.
- Use a unique password for any other account that shares details with your app profile, as a precaution, even though the company reports no credential access.
For security teams:
- Warn staff and customers about brand-impersonation phishing and smishing tied to this incident.
- Consider flagging inbound mail and SMS that mention the brand and ask for logins, until the leak is better understood.
- Review how your own mobile app back ends and member databases are protected. Check access control, API authorization and configuration, and monitor for bulk data access.
- Prepare a notification process for regulators and customers, since this case shows the breach may be recognized days after the access took place.
