Approximately 11.18 million customer records were reportedly accessed and leaked after attackers breached the membership system behind Burger King Japan’s official smartphone app. BK Japan identified the leak on October 13, 2026, and disclosed it publicly two days later.
The unauthorized access occurred from October 2 through October 7. For anyone who used the Burger King Japan app, this breach is worth understanding beyond the headline number.
What Was Exposed
The compromised records covered nearly every piece of information a customer provides when signing up for the app.
Compromised records included member IDs, email addresses, names in kanji and kana, telephone numbers, dates of birth, gender, prefecture of residence, registration type, mobile-order history flags, and email-verification status, according to BK Japan.
Credit-card numbers were not stored on the affected system, BK Japan said. At the time of disclosure, the company also reported finding no evidence that login passwords had leaked.
That reassurance matters, but it does not close the story. A profile containing your name, phone number, birthdate, location, and order history gives an attacker enough detail to craft a convincing impersonation message. That combination is precisely what makes a phishing lure credible, and this risk is an analytical implication of the disclosed data categories rather than a confirmed secondary impact.
What BK Japan Has Done
The company moved quickly to block further access and looped in regulators and outside experts.
After detecting the unauthorized access, BK Japan said it blocked communications from the identified source and put countermeasures in place. The company also engaged external cybersecurity specialists and reported the incident to Japan’s Personal Information Protection Commission.
BK Japan has begun notifying affected users directly. At the time of disclosure, the company said no fraudulent use linked to the incident had been confirmed.
The root cause is still under investigation. How attackers gained entry remains unconfirmed, and the entry method could involve any number of weaknesses that external specialists have yet to identify.
Your Next Steps
BK Japan’s own guidance gives you a clear checklist for protecting yourself right now.
BK Japan’s guidance is straightforward: treat any unexpected email, text, or call using Burger King Japan branding as potentially malicious. Do not click suspicious URLs, open unexpected attachments, or enter your account credentials in response to unsolicited messages.
Even though BK Japan has not confirmed password exposure, if you reused your app password on any other account, change it on those accounts now. That step costs a few minutes and closes a real risk.
Broader Context
The Burger King Japan incident comes amid a series of cyber incidents affecting Japanese organizations in 2026.
Reports during the year have described incidents at organizations including entertainment company Daiichi Kosho, cloud provider IDC Frontier, publisher Nikkei, railway operator Keio, car-sharing service Times Car, Sakura Internet, taxi operator Nihon Kotsu, and telecommunications company KDDI, though the Burger King case does not by itself establish a connection to those events.
Macnica researcher Yutaka Sejiyama reportedly tracked 119 personal-information incidents during the year. Attackers reportedly probed websites and APIs for weaknesses in access control, configuration, and authentication. When BK Japan’s investigation identifies the entry point, that finding will matter for every business in Japan running a loyalty program or mobile-ordering platform.
