Burger King Japan Hack Exposes 11M User Details; Credit Cards Safe
An outside party accessed the membership database of Burger King Japan, compromising personal data for over 11 million users in late October 2026.
Key points
- Unauthorized access occurred between October 2 and October 7, 2026.
- Exposed data includes names, phone numbers, emails, and birth dates.
- Credit card numbers were not stored in the affected system.
Burger King Japan confirmed an unauthorized data breach affecting approximately 11.18 million app members on October 15, 2026. According to Cyber Security News, an external party gained access to the system managing member information, exposing sensitive personal details without a confirmed link to ransomware or other attack groups.
The intrusion took place between October 2 and October 7, 2026. The company identified the breach on October 13 and subsequently notified Japan’s Personal Information Protection Commission. BK Japan stated that it blocked the unauthorized access. Outside experts are currently assisting the company in investigating the root cause and determining how the attacker initially entered the network.
Scope of Exposed Data
The compromised records include member IDs, full names in both kanji and kana, email addresses, and phone numbers. According to the company’s notice, the leak also involves registration types, gender, dates of birth, and the prefecture of residence. Prefectures identify regions within Japan rather than specific home addresses. The data also reveals whether members used mobile ordering and if their email addresses were verified.
BK Japan emphasized that credit card numbers were not stored in this specific system, meaning payment details were not leaked. The company stated that no leak of login passwords has been confirmed so far. However, this wording indicates the investigation into password security remains ongoing. Cyber Security News reported that the exposure concerns member records, not necessarily a verified count of unique individuals.
Impact and Response Measures
Affected members are receiving emails from BK Japan regarding the incident. The company has formed a dedicated response team to handle the fallout. According to reporting by Noticias SIN, BK Japan plans to strengthen system security and monitoring capabilities while working with outside specialists. These measures aim to improve future protection, though the investigation must still determine which specific controls failed.
No secondary harm, such as fraudulent use of the exposed information, has been confirmed by the company. The disclosed details do not establish a connection to another attack or a payment system compromise. BK Japan has not publicly identified an exploited vulnerability or confirmed whether stolen credentials were involved in the breach.
What should you do?
Users should monitor their email inboxes for official notifications from Burger King Japan. It is advisable to check for any unexpected password reset requests or login attempts on associated accounts. Individuals should review their financial statements for unauthorized transactions, although credit card data was not compromised in this specific incident.
What to do and how to stay safe: Burger King Japan
- Monitor email for official breach notifications and instructions from the vendor.
- Change passwords for any accounts that reuse the same credentials as the affected app.
- Enable multi-factor authentication on email and financial accounts to reduce credential theft risk.
- Watch for phishing attempts that reference the breach to steal additional personal information.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Were credit card numbers stolen in this breach?
No, Burger King Japan stated that credit card numbers are not stored in the affected system.
What dates was the system accessed by the attacker?
The unauthorized access occurred between October 2 and October 7, 2026.
Has the company confirmed if passwords were leaked?
The company has not confirmed a password leak, but the investigation is ongoing.
