Burger King Japan published an apology on October 15 after finding that an outsider had pulled member data out of the system behind its official smartphone app. The Burger King Japan data breach involves what BleepingComputer describes as a server “containing 11.18 million customer records,” and the company says the unauthorized access ran from October 2 through October 7.
Where it stands: The company says it blocked the source of the intrusion, filed a report with Japan’s privacy watchdog, the Personal Information Protection Commission (PPC), and is still working with outside security specialists to learn how the attackers got in. As of the latest reports, it has not named a culprit, and TechRadar says the company stressed “there is no evidence of data misuse yet.”
What happened in the Burger King Japan data breach
The company’s own timeline, as quoted by BleepingComputer, is precise. It said that “unauthorized access occurred between Friday, October 2, 2026, and Wednesday, October 7, 2026, resulting in a leak of member information,” and that this was confirmed on Tuesday, October 13. Two days after that confirmation, the public notice went up.
That gap matters for anyone who uses the app. For close to a week, someone had access to a system that knew who you were, how to reach you and what you had ordered. The company has not said when it first noticed something was wrong, only when the leak was confirmed.
The notice itself, translated in Security Affairs, keeps the wording short: “We have confirmed that customer membership information from the official app has been leaked externally following unauthorized access by a third party.” It does not say whether a vulnerability, a stolen password or a supplier was involved. Security Affairs notes the announcement “doesn’t identify the attackers or explain how they gained access.”
Which member details were exposed
Two outlets list the fields slightly differently, so both are worth reading. BleepingComputer says the server stored app users’ “names, dates of birth, gender, email addresses, phone numbers, and order history.” Security Affairs, working from the Japanese notice, gives a longer list that adds membership IDs, names written in both Japanese characters and kana, the prefecture where the member lives and the type of membership registration.
| Data type | Status, per the company |
|---|---|
| Name (kanji and kana) | Leaked |
| Email address and phone number | Leaked |
| Date of birth and gender | Leaked |
| Prefecture of residence, member ID | Leaked |
| Mobile ordering history flag | Leaked |
| Credit card numbers | Not stored on that server |
| Passwords | No evidence they were accessed |
The extra detail in the Security Affairs version is easy to skim past. The records also show “whether a customer has a mobile ordering history and whether their email address has been verified.” A verified email paired with a real name is precisely what a scammer wants: proof that a message will land in an inbox the victim actually reads.
Records are not the same as people
Several headlines rounded the figure off and called them customers. The company’s count is of records, and it has not said how many distinct people sit behind them. Some members may have more than one entry, and some may have deleted the app long ago. Treat the number as the size of the database that leaked, not a census of victims.
That caveat cuts both ways. Even if the true head count is lower, anyone who has ever registered with the Japanese app should assume their details were in the set until the company’s email notice says otherwise.
What was not taken, according to the company
The good news is narrow but real. BleepingComputer reports the company “says the compromised server did not store customer credit card numbers and that it found no evidence that the threat actors accessed user credentials.” In other words, nobody should expect fraudulent charges traced directly to this leak, and the company has no sign that app passwords were taken.
No evidence is not proof of absence, and the investigation is still running. The chain says permanent fixes, further forensic work and customer emails are all “ongoing,” which means the picture could change.
Why phishing is the real risk now
Stolen contact details rarely cost anyone money on their own. They become dangerous when a criminal uses them to write a message that feels personal. A text that greets you by name, mentions your prefecture and refers to a recent burger order will look far more trustworthy than the usual spam.
Burger King Japan seems to know this. Per BleepingComputer, it warned customers about “suspicious emails, SMS messages, and phone calls that may impersonate Burger King Japan,” and the notice tells members, in the Security Affairs translation, “Please do not access URLs, open attachments, or enter membership information or passwords if you receive a suspicious communication.”
The US Cybersecurity and Infrastructure Security Agency (CISA) offers a useful checklist for spotting this kind of bait. Its first warning sign is “Urgent or emotionally appealing language, especially messages that claim dire consequences for not responding immediately.” It also cautions that bad spelling no longer gives scams away: “in the era of artificial intelligence (AI) some emails will now have perfect grammar and spelling, so look out for the other signs.”
What app members should do this week
- Distrust messages about the breach itself. Fake “compensation coupons,” “account verification” requests and refund offers are the obvious next scam. Open the official app or type the company’s web address yourself instead of tapping a link.
- Follow CISA’s verification rule. If a call or text might be genuine, CISA advises: “don’t click on any link or call any number in the message. Look up another way to contact the company or person directly.”
- Change reused passwords. The company found no sign that passwords leaked, but if your app password also guards your email or bank, change those now. CISA notes that “Password managers tell us when we have weak or re-used passwords and can generate strong passwords for us.”
- Expect calls to your phone number. Phone numbers were in the data. Hang up on anyone who claims to be from the chain and asks for card details or a one-time code.
- Watch your inbox for the official notice. The company says it is emailing affected customers. Read it in your mail app, but do not follow links in any message you cannot verify.
If you have had a loyalty account misused before, our guide to what to do if a restaurant loyalty account is hacked walks through locking it down. For the general habits that defeat most of these lures, see what phishing is and how to avoid it.
Where this fits in Japan’s breach run
The disclosure lands during a busy stretch for Japanese companies, including breaches at Nikkei, the karaoke operator Daiichi Kosho and the car-sharing service Times Car. We cover those separately in our roundup of Japan’s October data breaches. No source has linked the Burger King Japan incident to any of them.
One lookup tool will not help yet. TechRadar checked Have I Been Pwned, the breach-notification site, and reported that it “has Burger King Russia on its list, but not Burger King Japan.” For now, the company’s own email is the only confirmation members will get that their record was in the leaked set.
Frequently Asked Questions
How many people were affected by the Burger King Japan data breach?
The company counts records, not people. BleepingComputer reports that the server held 11.18 million customer records belonging to users of the official Burger King Japan smartphone app. The company has not said how many separate individuals that represents.
Were credit card numbers stolen from the Burger King Japan app?
According to the company, no. It says the compromised server did not store card numbers, and it found no evidence that login credentials were accessed.
Do I need to change my Burger King Japan app password?
The company says it found no sign that passwords were taken. Changing it costs nothing, though, and if you used the same password anywhere else, change it on those accounts too.
How will Burger King Japan contact affected customers?
Security Affairs reports that email notifications to affected customers are under way. Treat any message that asks you to click a link, open an attachment or enter your member details with suspicion, even if it uses your real name.
Is the Burger King Japan breach connected to Burger King in the US?
No source links it to US operations. The incident involves the app run by Burger King Japan, the chain’s Japanese subsidiary, and the breach was reported to Japan’s privacy regulator.
Sources
- Burger King Japan data breach exposes 11 million customer records — BleepingComputer (Sergiu Gatlan), October 16, 2026
- Burger King Japan Data Breach Impacted 11 Million Customers — Security Affairs (Pierluigi Paganini), October 16, 2026
- Whopper of a data breach sees Burger King Japan expose over 11 million customer records — TechRadar Pro, October 2026 (after the October 15 notice)
- Recognize and Report Phishing — Cybersecurity and Infrastructure Security Agency (CISA), undated archived guidance page, retrieved October 22, 2026
- Use Strong Passwords — Cybersecurity and Infrastructure Security Agency (CISA), undated archived guidance page, retrieved October 22, 2026
This article is news reporting and general security information based on the public sources listed above, as they stood on the dates shown. Incident details often change as investigations continue; check the affected company’s own status page and notices for the latest. Data Breach Radar is not affiliated with any company named here.