Burger King Japan breach exposes 11 million app customer records

Burger King Japan has disclosed a data breach affecting 11.18 million customer records tied to its official smartphone app, BleepingComputer reported on October 16, 2026. According to the company's notice issued on October 15, attackers accessed a server storing the records between October 2 and October 7. BleepingComputer reports that the data was leaked online.

What happened

Burger King Japan, which operates around 350 restaurants in the country, completed its follow-up investigation on October 13 and published its notice two days later, according to BleepingComputer. The company has not explained how the attackers gained access. It says it is investigating the incident with external cybersecurity experts and that it "immediately blocked access from the source in question."

The company reported the incident to Japan's Personal Information Protection Commission (PPC) and apologized to affected customers. It also stated that no secondary damage, such as fraudulent use of the data, had been confirmed so far.

What data was exposed

According to the notice, the compromised records include:

• Full names
• Dates of birth and gender
• Email addresses and phone numbers
• Order history

Burger King Japan says the affected server did not store credit card numbers and that it found no evidence that user login credentials were accessed.

Context

BleepingComputer places the incident within a wave of cyberattacks on major Japanese companies in 2026. Citing Macnica researcher Yutaka Sejiyama, the outlet says 119 incidents involving theft or exposure of personal information have been logged in Japan this year. According to the researcher, attackers have been probing websites and APIs for weaknesses in access control, configuration and authentication, and exploiting known vulnerabilities.

What to do

Because the leaked data combines contact details with order history, it can be used to craft convincing phishing messages. Burger King Japan advises customers to be wary of suspicious emails, SMS messages and phone calls claiming to come from the company, and not to click links, open attachments or enter membership details or passwords in response to such messages. Users who reuse their app password on other services may also want to change it as a precaution, even though the company says it has found no evidence that credentials were accessed.