Burger King Japan breach exposes 11.18 million customer records

Burger King Japan says attackers accessed a server holding personal information for 11.18 million users of its official smartphone app. The company said it concluded a follow-up investigation on October 13, 2026, and apologized to customers whose data was stolen in early October and leaked online.

The compromised server stored customers’ names, dates of birth, gender, email addresses, phone numbers, and order histories. Burger King Japan said unauthorized access occurred between October 2 and October 7, 2026. It said it blocked access from the source once it became aware of the intrusion.

The company said the server did not store customer credit card numbers and that it found no evidence attackers accessed user credentials. It reported the breach to Japan’s Personal Information Protection Commission and is investigating how the server was accessed with help from external cybersecurity experts. Burger King Japan said it had not confirmed any secondary damage, such as fraudulent use.

The company warned affected customers to watch for suspicious emails, text messages, and calls impersonating Burger King Japan. It also advised them not to click links, open attachments, or enter membership information or passwords in response to such messages.

Macnica researcher Yutaka Sejiyama has logged 119 cybersecurity incidents involving personal information theft or exposure this year. The source says attackers have been probing websites and APIs for weaknesses in access control, configuration, and authentication, as well as exploiting known vulnerabilities.