Burger King Japan discloses app data breach affecting 11.18 million member records

On 15 October 2026, BK Japan — the operator of the official mobile app for Burger King in Japan — announced that attackers had gained unauthorized access to its member database, exposing roughly 11.18 million records. The company said its investigation had established that the intrusion took place between 2 and 7 October, that it confirmed the leak on 13 October, and that it had reported the incident to Japan's Personal Information Protection Commission. BK Japan cautioned that the 11.18 million figure counts database records rather than a verified number of unique individuals.

According to the company's notice, the exposed data included member IDs, email addresses, registration types, prefectures, gender, dates of birth, names in both kanji and kana, and telephone numbers, along with flags indicating whether a member had any mobile-ordering history (its presence or absence only, with no purchase details) and whether an email address had been verified. BK Japan said that credit-card numbers were not affected because it does not retain them on the system, and that it had found no confirmation of leaked login passwords, though that point remained under investigation.

Response

The company said it blocked the source of the unauthorized connections immediately upon discovery, stood up an incident-response headquarters, and put temporary countermeasures in place while working with outside specialists on permanent fixes and a continuing investigation. Affected customers were being notified by email, and BK Japan said it would strengthen its system security and monitoring. As of the announcement, no fraudulent use or other secondary harm had been confirmed, and the method of initial access and the underlying cause remained undetermined. No threat actor had claimed responsibility, and the company urged customers to be alert to phishing messages impersonating the brand.