Burger King Japan: External Actor Accessed App System, Exposing Data for 11M Users

Burger King Japan disclosed on October 15, 2026, that an unauthorized party accessed its app membership management system. The operator confirmed the incident after detecting the intrusion, which occurred between October 2 and October 7. The company notified Japan’s Personal Information Protection Commission and established a response team to manage the fallout.

What information was exposed?

The breach affected approximately 11.18 million records linked to official app members. Exposed fields include member IDs, full names in kanji and kana, email addresses, phone numbers, gender, dates of birth, and prefecture. The data also reveals whether users utilized mobile ordering and if their email addresses were verified. Credit card numbers were not involved, as BK Japan does not store them.

Were passwords or purchase details compromised?

No leak of login passwords has been confirmed so far, though the investigation remains ongoing. The mobile ordering field indicates feature usage but does not contain detailed purchase histories or individual order contents. A prefecture identifies a region rather than a complete home address. BK Japan stated that no secondary harm, such as fraudulent use of the information, has been confirmed.

How did the attacker gain access?

Outside experts are assisting with the investigation to determine the cause of the breach and how the attacker first entered the system. BK Japan has not publicly identified an exploited vulnerability or confirmed whether stolen credentials were involved. The disclosed details do not establish a connection to ransomware, a payment system compromise, or another specific attack vector.

What steps has the company taken?

BK Japan blocked the unauthorized access and is emailing affected members directly about the incident. The company plans to strengthen system security and monitoring while working with outside specialists. These measures aim to improve future protection, but the investigation must still determine which controls failed to prevent the initial intrusion.

Questions to ask your suppliers

Security operations teams should verify whether vendors store sensitive customer data in separate, isolated systems rather than combining it with operational databases. Check if suppliers conduct regular penetration testing and provide transparent incident response timelines. Determine who within your organization receives immediate alerts about third-party breaches. Ensure contracts mandate timely notification of unauthorized access, allowing your team to assess risk to shared infrastructure before public disclosure occurs.

What to do and how to stay safe: Burger King Japan

• Monitor email accounts associated with the app for phishing attempts or suspicious activity.
• Change passwords for any other services that reuse the same credentials.
• Enable multi-factor authentication on personal accounts to reduce account takeover risk.
• Watch for unexpected communications claiming to be from the vendor regarding the breach.

Step-by-step guide: Data Breach Response Plans: Real Value vs Operational Limits

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did Burger King Japan lose credit card data?

No, BK Japan stated it does not hold credit card numbers, so those details were not leaked in this incident.

How many people were affected?

The breach exposed about 11.18 million records linked to app members, though this is not a verified count of unique individuals.

When did the breach occur?

The unauthorized access occurred between October 2 and October 7, 2026, and was confirmed on October 13.