Burger King Japan Confirms Breach Exposing 11.18 Million Customer Records
The Japanese subsidiary disclosed that unauthorized access to its mobile app system leaked personal data and order histories for millions of users.
Key points
- Unauthorized access occurred between October 2 and October 7, 2026.
- The breach exposed names, emails, phone numbers, and order histories.
- Payment information was not compromised in this incident.
Burger King Japan confirmed on October 13, 2026, that unauthorized third-party access exposed the personal data of 11.18 million customers. The intrusion targeted the system managing member information for the company’s official smartphone application, resulting in a significant leak of user records.
The company stated in a notification letter that it identified potential unauthorized access and immediately blocked the source upon discovery. The investigation determined that the breach window spanned from Friday, October 2, to Wednesday, October 7, 2026. This timeline represents the period during which the intruder had access to the member information database.
Scope of Data Exposure
The compromised records primarily belonged to users of the Burger King Japan mobile app. According to TechRadar, the leaked data included sensitive personally identifiable information such as names, dates of birth, genders, email addresses, and phone numbers. Order histories were also part of the stolen dataset, providing a detailed view of customer purchasing behavior and preferences.
Although payment details and credit card information were not exposed, the remaining data poses significant risks. TechRadar noted that this combination of PII is sufficient for attackers to launch convincing phishing campaigns. Such data can facilitate business email compromise attempts or serve as a vector for malware and ransomware distribution.
Regulatory Response and Past Incidents
Burger King Japan reported the incident to Japan’s Personal Information Protection Commission while continuing its internal investigation. The company apologized for the inconvenience and concern caused to customers and other stakeholders. It emphasized that, at the time of the report, no secondary damage or fraudulent use of the stolen data had been confirmed.
This event follows previous security incidents involving the global brand. In 2024, the Russian subsidiary of Burger King suffered a data breach from unknown threat actors, with data leaking online in late September of that year. Additionally, in October 2024, Burger King disclosed an attack on Mindbox, a domestic marketing automation platform it utilized for operations.
What should you do?
Customers who used the Burger King Japan mobile app during the affected period should monitor their accounts for suspicious activity. Users should review their email inboxes for unexpected messages requesting personal information or login credentials. Changing passwords for associated email accounts can reduce the risk of account takeover attempts.
What to do and how to stay safe: Burger King Japan
- Monitor email inboxes for phishing attempts that reference your Burger King order history or personal details.
- Change passwords for the email accounts associated with the compromised Burger King app profiles.
- Enable multi-factor authentication on email and financial accounts to add an extra layer of security.
- Review credit reports and bank statements regularly to detect any unauthorized activity or identity theft signs.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the Burger King Japan breach include credit card numbers?
No, the company confirmed that payment information and credit card data were not compromised in this incident.
When did the unauthorized access to the system occur?
The breach occurred between October 2, 2026, and October 7, 2026, according to the company's investigation.
How many customer records were exposed in the leak?
A total of 11.18 million customer records were exposed in the data breach.
