Burger King Japan App Membership System Breach Leaks 11.18M Names, Emails, Phone Numbers
An outsider accessed the membership system of the Japanese fast-food chain, leaking names, emails and phone numbers without compromising payment details.
Key points
- The breach affects records from the official Burger King Japan mobile application.
- Exposed data includes full names, birth dates, email addresses and phone numbers.
- Credit card information and login passwords were not confirmed to be stolen.
Burger King Japan confirmed on October 15, 2026, that an unauthorized party accessed its app membership database, exposing personal information for approximately 11.18 million records. The incident was disclosed after the company detected the intrusion and verified the extent of the data leak.
The unauthorized access occurred between October 2 and October 7, 2026, with the company confirming the leak on October 13. This figure represents exposed records rather than a verified count of unique individuals, meaning some users may appear multiple times in the dataset.
What information was compromised
According to Cyber Security News, the leaked data includes member IDs, email addresses, registration types, prefectures, genders, dates of birth, and full names in both kanji and kana scripts. Phone numbers were also exposed. The records indicate whether members used mobile ordering and if their emails were verified, but these flags do not reveal specific purchase histories or order contents.
Prefecture data identifies a general region within Japan rather than a precise home address. BK Japan stated it does not store credit card numbers, so payment details were not involved. No confirmed leak of login passwords has been reported, though the investigation remains ongoing.
Scope of the incident
The company blocked the unauthorized access and established a response team to handle the fallout. BK Japan notified Japan’s Personal Information Protection Commission and is emailing affected members directly about the incident. Outside experts are assisting in the investigation to determine how the attacker initially entered the system.
The operator has not publicly identified a specific vulnerability or confirmed whether stolen credentials were used. The disclosed details do not link this event to ransomware, a payment system compromise, or any other concurrent attack.
Our take on the response
BK Japan plans to strengthen system security and monitoring while collaborating with external specialists. These measures aim to improve future protection, but the root cause of the access and the specific controls that failed remain under investigation. No secondary harm, such as fraudulent use of the exposed information, has been confirmed at this time.
For customers and users
Affected individuals should review their email inboxes for official notices from Burger King Japan. It is prudent to check other online accounts for unusual activity, as attackers often use leaked email and password combinations for credential stuffing. Users should enable multi-factor authentication on important accounts to add an extra layer of security. Be wary of phishing emails claiming to offer refunds or password resets related to this breach, as scammers frequently exploit such incidents.
Background: Ransomware
Stop ransomware by enforcing least privilege, maintaining offline backups, and disabling macro execution. These three measures remove the attacker’s ability to encrypt your data or spread across your network. Software updates help, but they do not replace strict access controls and immutable storage.
Read the full guide: How to Stop Ransomware: 3 Layers That Actually Work
What to do and how to stay safe: Burger King Japan
- Verify that any communication regarding this breach comes from an official domain used by Burger King Japan.
- Change passwords for any accounts that share the same credentials used for the BK Japan app.
- Monitor financial statements and credit reports for signs of unauthorized activity or identity theft.
- Contact your telecommunications provider if you receive suspicious calls or messages referencing this incident.
Step-by-step guide: 7 Credential Leak Mistakes That Expose Your Accounts
General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the breach expose credit card numbers?
No, BK Japan stated that it does not hold credit card numbers, so those details were not leaked.
Are login passwords involved in the leak?
No confirmed leak of login passwords has been reported, though the investigation is ongoing.
When did the unauthorized access occur?
The access occurred between October 2 and October 7, 2026, with the leak confirmed on October 13.
