Pierluigi Paganini
October 16, 2026
Burger King Japan has disclosed a data breach that exposed the personal information of approximately 11.18 million official app members. Burger King Japan, the company operating the fast-food chain in the country, said attackers accessed the system managing customer membership information between October 2 and October 7, 2026. The company disclosed the incident on October 15, after discovering the data leak two days earlier.
In its official notice published on October 15, the company confirmed the unauthorized access and apologized to affected customers. The announcement doesn’t identify the attackers or explain how they gained access. BK Japan says it’s working with external security specialists to determine the cause.
“We have confirmed that customer membership information from the official app has been leaked externally following unauthorized access by a third party.” reads the data breach notification.
The compromised data includes membership IDs, email addresses, names in Japanese characters and kana, phone numbers, dates of birth, gender, prefecture of residence, and membership registration type. The exposed information also indicates whether a customer has a mobile ordering history and whether their email address has been verified.
These details can be useful to criminals even without payment data or passwords. Attackers can use them to craft convincing phishing emails, text messages, or phone calls that refer to a customer’s real identity and relationship with Burger King. A message that includes a person’s name, phone number, and other accurate details may look far more credible than a generic scam.
Burger King Japan confirmed it does not store credit card numbers and found no evidence that passwords were exposed, with no confirmed cases of fraud so far. However, these factors do not completely rule out the risk of future misuse.
According to the company, unauthorized access took place from October 2 through October 7, and the leak was confirmed on October 13. BK Japan says it blocked access from the source of the unauthorized communications as soon as it became aware of the incident.
The company has also introduced temporary countermeasures, established an incident response team, and reported the breach to Japan’s Personal Information Protection Commission. It says permanent security improvements, further investigation with external specialists, and email notifications to affected customers are ongoing.
“At present, we have confirmed that the unauthorized access was carried out by a third party.” continues the notification.
The company has not yet disclosed the precise circumstances that made the intrusion possible, and the investigation is continuing. Until more details emerge, it’s too early to draw conclusions about the initial access vector or attribute the attack to a particular threat actor.
Large-scale data breaches create long-lasting risks for follow-on attacks, as criminals can use stolen details for phishing, impersonation, and highly convincing scams.
BK Japan urges customers to stay vigilant against fraudulent emails, texts, and calls, warning them never to click unverified links or share sensitive credentials.
The core danger is that attackers no longer need network access to cause harm; they can leverage existing stolen data to target customers directly through social engineering.
“Please do not access URLs, open attachments, or enter membership information or passwords if you receive a suspicious communication.” concludes the report.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Burger King Japan)
