Burger King Japan app breach exposes 11.18M members

BK Japan, which runs Burger King restaurants in Japan, said on October 15, 2026, that an outsider had accessed about 11.18 million member records from its official app. Names, phone numbers, email addresses and birth dates were among the data. The leak is one of the largest in a wave of attacks on Japanese companies this month, and it hands scammers a ready list of people to target.

The unauthorized access ran from October 2 to October 7, and the company found it on October 13, ITmedia NEWS reports. It reached the system that manages the app's member information. The company has not said how the attacker got in.

What was exposed

ITmedia and GAME Watch list the same fields. BleepingComputer, which reported the disclosure in English, describes one of them as order history.

Exposed	Not exposed
Member ID	Credit card numbers, which the company says it does not hold
Full name, in kanji and katakana	Login passwords, with no leak confirmed so far
Email address and whether it was verified
Phone number
Date of birth and gender
Prefecture, the region of Japan the member lives in
Registration type
Whether the member has used mobile ordering

The company says it has confirmed no secondary damage, such as fraudulent use of the data. "We sincerely apologize for the great inconvenience and concern," it said, in BleepingComputer's translation.

What the company has done

BK Japan blocked traffic from the source of the access and set up a response team, ITmedia reports. It also took these steps:

• reported the leak to Japan's Personal Information Protection Commission, the national privacy regulator
• began contacting affected members one by one
• started an investigation with outside specialists into the entry route and cause
• began work on stronger security and monitoring to stop a repeat, according to GAME Watch

The company also warned members about fake messages. People should watch for suspicious emails, text messages and phone calls that pretend to come from Burger King, ITmedia reports. They should not open links or attachments in them, and should never type in their member details or password.

Part of a wider wave

The leak lands in a bad month for Japanese companies. Japan's government stepped up its cyber warnings on October 9, after more than 20 firms reported attacks. The car-sharing service Times Car alone leaked about 6.6 million accounts.

At 11.18 million records, the Burger King leak is larger than any single case in that earlier report. None of the sources links it to the other attacks, and the company has named no attacker.

What this means for developers

• Treat contact data as sensitive. No card numbers or passwords leaked here, yet the data still enables targeted scams. Name, phone, email and birth date together let a scammer write a believable message.
• Ask why you keep each field. Apps often collect birth date, gender and region for marketing. Every field you store is one more field that can leak. Drop the ones you do not use.
• Keep payment data out of your own systems. BK Japan says it does not hold card numbers, so none could leak. Using a payment provider to store cards limits the damage of a breach like this one.
• Watch for slow detection. The access ran for six days, and the company found it six days after that. Alerts on unusual bulk reads of a member database would shorten that gap.
• Warn users before the scammers arrive. BK Japan told members what fake messages to expect. If you run an app with a large member base, prepare that warning now, before you need it.