Burger King Japan breach exposes 11.18M app member records

Burger King Japan disclosed a data breach after an intruder reached a server holding 11.18 million customer records tied to its official smartphone app. The company says unauthorized access ran from October 2 to October 7, 2026, was confirmed on October 13, and has been reported to Japan's Personal Information Protection Commission. No payment-card data was stored on the server, and the company says it has found no evidence that app credentials were accessed. If you use the Burger King Japan app, treat your name, contact details and order history as exposed and expect phishing.

The disclosure comes from Burger King Japan's own press release; detailed reporting is at BleepingComputer and News On Japan.

What was exposed

Per the company statement, the affected server managed member information for the official app. The records contained:

• Names
• Dates of birth
• Gender
• Email addresses
• Phone numbers
• Order history

The company says the server did not store credit card numbers, and that it has not confirmed any fraudulent use of the data so far.

What's confirmed

• Who: Burger King Japan, the chain's Japanese subsidiary.
• Scope: 11.18 million official-app member records on the accessed server.
• Window: Unauthorized third-party access between October 2 and October 7, 2026, determined October 13.
• Actor: None named. No group has claimed responsibility, and the intrusion method has not been disclosed — the company says it is still investigating with outside experts.

Action checklist

1. If you're a Burger King Japan app user, assume your name, date of birth, email and phone number are in attacker hands. There's nothing to patch, but the data is now a durable phishing and social-engineering input.
2. Watch for impersonation. The company explicitly warned of phishing emails, SMS and calls posing as Burger King. Do not act on account, coupon or "verify your details" messages that arrive out of the blue.
3. Rotate the app password if you reused it elsewhere — the company says credentials weren't accessed, but password reuse makes any breach a cross-service problem.

Context

This is the second eight-figure Japanese app breach in a fortnight. In early October, Monogatari — operator of the Yakiniku King chain — said roughly 10.8 million official-app user records were leaked. No reporting links the two incidents, but the shape is identical: a consumer loyalty app backing a large customer database, breached through a server rather than the app itself, with the count surfacing in a regulator notification. Loyalty programs concentrate exactly the identity data — name, date of birth, contact details — that fuels downstream fraud, and they rarely get the security budget the payment path does.