Burger King Japan Data Breach Exposes 11.18 Million Records

BK Japan, the company that operates Burger King's restaurants and official smartphone app in Japan, disclosed on October 15, 2026, that an unauthorized third party accessed the system managing its app membership data between October 2 and October 7, 2026. According to the company's own notice, the exposure affects roughly 11.18 million membership records and includes names, dates of birth, gender, email addresses, phone numbers, and whether members had placed mobile orders. BK Japan says credit card numbers were never stored on the affected server and that it has found no evidence login passwords were accessed. Anyone who has used the Burger King Japan app should watch for phishing emails, texts, or calls that reference their real name or order activity, avoid tapping links in unsolicited messages claiming to be from Burger King, and change their app password as a precaution.

Who operates Burger King in Japan

Burger King's restaurants in Japan are run by BK Japan, a Tokyo-headquartered company that holds the rights to operate and franchise the Burger King brand domestically, separate from the chain's U.S. parent, Restaurant Brands International. BK Japan runs the official Burger King smartphone app, which Japanese customers use for mobile ordering, loyalty rewards, and store locators, and it was this app's backend membership system — not the point-of-sale or payment system used inside restaurants — that the company says was accessed without authorization. Background on the broader Burger King brand and its history is available on Wikipedia; BK Japan's own notice is the only authoritative source for details specific to this breach.

What happened in the Burger King Japan breach

In a notice posted to its corporate website, BK Japan said it detected that a third party had gained unauthorized access to the server that manages membership information for its official smartphone app. The company says it has blocked access from the source it identified and is now working with outside cybersecurity specialists to determine exactly how the intrusion occurred. As of its statement, BK Japan said it had not confirmed any secondary damage, such as fraudulent use of the exposed data, but it stopped short of ruling that out going forward.

BK Japan has not published a detailed technical account of the attack, and it has not said whether the intrusion involved stolen credentials, a software vulnerability, or another method. The company describes the investigation as ongoing, so the root cause remains unconfirmed and could be revised in a later update.

Timeline of the incident

The dates below come from BK Japan's own notice. The gap between the end of the unauthorized access window and the public disclosure is typical for incidents that require forensic confirmation before a company is willing to name a scope.

What data was exposed — and what wasn't

According to BK Japan's notice, the exposed fields tied to app membership accounts include member ID, email address, registration type, prefecture of residence, gender, date of birth, name (recorded in both kanji and katakana), phone number, whether the account had any mobile order history, and whether the email address had been verified. The company has not published the detailed contents of individual orders, only whether an account had order activity on record, so treat "order history" as a flag rather than itemized purchase data unless BK Japan says otherwise in a future update.

BK Japan says two categories of sensitive data were not affected. It states that it does not store customer credit card numbers on the system in question, so payment card data was not exposed in this incident. It also says it has found no evidence that login passwords were accessed, though it has not described what technical review led to that conclusion. Both points come directly from the company and have not been independently verified by outside security researchers at the time of writing.

How many people are affected

BK Japan's notice puts the figure at approximately 11.18 million membership records. The company describes this as a record count rather than a confirmed count of unique individuals, which is a meaningful distinction: a single person can hold more than one account record, and the figure has not been described as deduplicated. Until BK Japan or a regulator publishes a more precise breakdown, it is safest to describe the scope as "about 11.18 million app membership records" rather than asserting that exactly that many distinct people were affected.

Given that BK Japan's app and loyalty program have been used broadly across its Japanese restaurant network, a breach of this size would rank among the larger consumer data exposures reported in Japan in recent years, though BK Japan has not made any direct comparison to other incidents in its own statement.

It is also worth noting what the company has not said. BK Japan's notice does not specify how long the attacker had the ability to query or download records within the five-day access window, nor does it confirm whether the full 11.18 million records were actually exfiltrated, as opposed to merely accessible to the intruder during that period. Breach notices in Japan, as elsewhere, often describe the maximum number of records an attacker could have reached rather than a confirmed download count, so the real-world scope of data actually taken could turn out to be smaller — or BK Japan could revise the figure upward if its investigation finds additional exposure.

BK Japan's response and ongoing investigation

BK Japan says it took the following steps after detecting the intrusion: it blocked the unauthorized access, began an internal review, and engaged external cybersecurity specialists to help determine the cause and scope. The company says it is also reviewing and strengthening its security monitoring to prevent a recurrence, though it has not detailed specific technical changes publicly.

The company has published a customer contact line for questions related to the incident and says it is notifying affected users directly, including guidance to be cautious of emails, text messages, or phone calls that impersonate Burger King or BK Japan. It specifically warned customers not to click links in unsolicited messages and not to enter account credentials or personal information in response to messages claiming to be from the company, directing anyone with questions to type the official app or website address manually rather than following a link.

Report to Japan's privacy regulator

BK Japan says it has reported the incident to Japan's Personal Information Protection Commission (PPC), the national authority that oversees compliance with Japan's Act on the Protection of Personal Information. Under that law, businesses handling personal data in Japan are generally required to report qualifying breaches to the PPC and, in many cases, to notify the individuals affected. BK Japan's notice frames this report as already filed, but the PPC has not published its own findings or any enforcement action related to this incident as of this writing, so any regulatory conclusions about the breach's cause or BK Japan's compliance remain pending.

What affected users should do now

If you have ever registered for the Burger King Japan app or its membership program, BK Japan's notice and general security practice suggest the following steps:

• Change your app password. Even though BK Japan says it found no evidence passwords were accessed, resetting the password on the Burger King Japan app — and on any other account where you reused that same password — closes off a low-cost precaution.
• Watch for phishing attempts. Because names, birth dates, email addresses, and phone numbers were exposed, scammers can craft convincing messages that reference accurate personal details. Treat unsolicited emails, texts, or calls claiming to be from Burger King with suspicion, especially any that ask you to click a link or provide further information.
• Never tap links in unexpected messages. BK Japan explicitly advises typing the app or website address directly, or opening the app from your phone's home screen, rather than following a link sent by email, SMS, or messaging app.
• Monitor for unusual activity. Keep an eye on the email address and phone number you used to register, since both could now be targeted for follow-up scams even though BK Japan says it has not confirmed any fraudulent use so far.
• Contact BK Japan with questions. The company has set up a customer inquiry line referenced in its public notice for people who believe their data may have been involved.

There is no indication in BK Japan's notice that payment cards need to be canceled or reissued, since the company says card numbers were not stored on the affected system. If you notice unauthorized charges on a card used with the app, treat that as a separate matter to raise with your card issuer, since BK Japan has not linked such activity to this incident.

Why this kind of data matters to scammers

Security researchers who track large consumer breaches generally note that exposed names, birth dates, email addresses, and phone numbers — even without passwords or payment data — are enough to fuel targeted phishing and impersonation attempts, because the accuracy of the personal details makes fraudulent messages more convincing. BK Japan's own notice reflects this concern, since it devotes specific guidance to warning customers about suspicious communications rather than only addressing account security. As with other breaches involving contact and demographic data, the realistic risk for most affected users is nuisance phishing and social-engineering attempts rather than direct financial theft, though that can change if attackers combine this data with information leaked elsewhere.

How this breach compares to other recent incidents

BK Japan's disclosure adds to a string of large breach notifications reported this year across different sectors. It shares some characteristics with other recent incidents Pandromeda has covered, including the breach at health-tech company iRhythm, where attackers accessed systems holding sensitive personal records, and the CenterPoint Energy breach affecting more than a million customers, where a utility provider disclosed unauthorized access to customer data months after the fact. In each case, companies emphasized what was not exposed — payment details, in BK Japan's case — while still reporting large numbers of affected records. Security professionals generally argue that keeping internet-facing systems patched and monitored is one of the clearest ways organizations can reduce how often this kind of intrusion happens, a point also raised in Pandromeda's coverage of recent enterprise software vulnerabilities actively being exploited.

What happens next

BK Japan says its investigation with outside cybersecurity specialists is continuing, and the company has not yet published a root-cause finding or a final count of affected individuals. Japan's Personal Information Protection Commission has been notified and could eventually publish its own assessment or guidance, though no such findings are public yet. Pandromeda will update this story if BK Japan, the PPC, or independent researchers release new details about how the intrusion occurred, whether the data has appeared for sale or distribution elsewhere, or whether the affected-records estimate changes. In the meantime, anyone who has used the Burger King Japan app should treat the company's own notice as the authoritative source for next steps and remain alert to phishing attempts that reference the exposed personal details.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage