Burger King Japan data breach: 11.18 Million Records Exposed in App Incident
In short
The October 2026 incident exposed 11.18 million Burger King Japan app member records. Review the facts on what was accessed and steps taken.
The Burger King Japan data breach involved unauthorized access to the membership system behind the company's official smartphone app. Between October 2 and 7, 2026, attackers reached roughly 11.18 million records. The company confirmed the scope on October 13 and announced the incident publicly on October 15.
No credit card data or login passwords were stored on the affected system, and no secondary misuse has been reported so far. The breach forms part of a broader pattern of corporate incidents in Japan during the same period.
Burger King Japan data breach: Records exposed and scope
The incident affected the app's membership database operated by BK Japan in Tokyo. Exposed fields included member ID, name in both kanji and kana, email address with verification status, phone number, date of birth, gender, prefecture of residence, registration type, and a flag indicating mobile order history. No detailed transaction histories or payment details appeared in the leaked data.
The company confirmed that credit card numbers are not stored on the compromised system. Passwords also showed no signs of exposure. Affected users received individual email notifications, and the company advised everyone to disregard any suspicious messages claiming to come from Burger King.
- Member ID and full name (kanji/kana)
- Email address and verification status
- Phone number, date of birth, gender
- Prefecture of residence and registration type
- Mobile order history flag only
| Data category | Exposed | Not exposed |
|---|---|---|
| Personal identifiers | Name, DOB, gender, prefecture | — |
| Contact information | Email, phone | — |
| Financial data | — | Credit card numbers |
| Authentication | — | Passwords |
| Transaction details | Order history flag only | Full purchase records |
Company actions and ongoing security steps
Burger King Japan blocked the unauthorized access source immediately after detection. It established an incident response headquarters, engaged external cybersecurity specialists, and reported the event to Japan's Personal Information Protection Commission. Interim security measures were applied while permanent fixes and enhanced monitoring remain in development.
Official statements noted that no fraudulent use of the exposed information has been confirmed. The company continues to investigate the initial intrusion method with third-party experts. Users can expect further updates once the full cause analysis concludes.
Practical implications for app users
Individuals whose records were exposed should remain alert for phishing attempts that reference Burger King Japan. Any unexpected emails, SMS messages, or calls asking for personal details or account credentials should be ignored. The absence of password leakage reduces immediate account takeover risk, yet the volume of personal data still warrants caution with future communications.
Businesses and users evaluating similar membership apps can review how data storage choices, such as avoiding on-site credit card retention, limit potential harm. Monitoring official notices from the company and the Personal Information Protection Commission provides the clearest updates on remediation progress.
Frequently asked questions
What information was taken in the Burger King Japan data breach?
The breach exposed member IDs, names, email addresses, phone numbers, dates of birth, gender, prefectures, registration types, and mobile order history flags for 11.18 million records. Credit card data and passwords were not stored on the affected system.
Has any misuse of the exposed data been confirmed?
As of October 19, 2026, Burger King Japan has reported no confirmed cases of secondary damage such as fraudulent account use or identity theft linked to the incident.
What should affected users do now?
Users should delete or ignore any unexpected messages claiming to be from Burger King and avoid clicking links or providing personal information. They should also watch for official updates from the company via verified email channels.
Did Burger King Japan report the incident to regulators?
Yes, the company notified Japan's Personal Information Protection Commission and set up an internal incident headquarters with support from external cybersecurity experts.
TrustScope
Comments 5