Burger King Japan Data Breach Exposes 11.18 Million App Members

Your burger order should not put you on a scammer's mailing list. Yet that is the situation facing about 11.18 million Burger King Japan app members after the company confirmed that attackers accessed the system managing its official app memberships.

BK Japan, the company operating Burger King in the country, disclosed the breach in a public notice on October 15, 2026. Attackers had unauthorized access to the membership system between October 2 and October 7. The company discovered signs of the intrusion on October 13, confirmed the data leak the same day, blocked the suspected source, and then took two days to complete its follow-up investigation before telling the public.

The exposed data reads like a starter kit for phishing: membership IDs, names in Japanese kanji and kana, phone numbers, email addresses, dates of birth, gender, prefecture of residence, membership registration type, whether each member had used mobile ordering, and whether their email address had been verified. Burger King Japan said the affected server did not store credit card numbers and that it had found no evidence that login passwords were exposed.

Why no passwords still means real danger

There is a comforting reflex in breach disclosures: no passwords, no payment cards, so no big problem. That reflex is wrong, and security researchers keep saying so.

The details leaked here are exactly the ingredients that make phishing work. A scam text that opens with your real name, references your phone number, and mentions that you use the Burger King app is far more believable than a generic "dear customer" blast. Attackers can pair birth dates and email addresses with data from other breaches to build convincing pretexts for identity theft, account takeover attempts on other services, or phone-based social engineering.

Burger King Japan itself warned affected customers to watch for suspicious emails, text messages, and phone calls impersonating the company, and to avoid clicking links, opening attachments, or entering member information on pages they did not navigate to themselves.

The company has reported the incident to Japan's Personal Information Protection Commission and is working with external cybersecurity specialists to determine how the attackers got in. As of the disclosure, how the attackers gained access was still under investigation, and the company said it had confirmed no secondary damage such as fraudulent use of the stolen data.

A wave, not an isolated incident

This breach is part of a much larger and genuinely alarming pattern. Japan is experiencing what Trend Micro described in an October 12 threat advisory as an unprecedented surge of cyberattacks, with the country recording more publicly disclosed incidents in the first nine months of 2026 than in all of 2025. September alone saw 86 incidents, up about 37 percent from July.

On October 9, Masaaki Taira, who chairs the ruling Liberal Democratic Party's National Cybersecurity Strategy Headquarters, said the country was in "a state of emergency in cyberspace," prompting the National Cybersecurity Office to send mandatory security guidance to ministries, local governments, and private companies.

Other recent Japanese breaches tell the same story on a bigger scale. Software company SourceNext said a member information API was abused over four days to take 22.5 million records, including passwords that were encrypted rather than hashed. The e-commerce platform ShopServe's final report put its breach at about 23.36 million people across 7,858 shops. Yamato Transport confirmed about 5.26 million records taken from its Kuroneko pay-later service. Qilin ransomware listed Keio, the Tokyo railway, retail, and hotel group, on its leak site on October 16.

Attackers are repeatedly hitting the same soft spot: customer-facing membership systems and mobile app backends where massive amounts of personal data sit behind APIs that were never built for hostile traffic.

What the company did and did not say

Burger King Japan's notice followed the standard breach-disclosure script: confirm the leak, apologize, say external specialists are investigating, and note that no misuse has been confirmed. What it did not say is arguably more interesting. The announcement does not identify the attackers, does not explain the initial entry point, and does not say how the company first noticed the intrusion.

That opacity is common in Japanese corporate breach disclosures, and it leaves customers guessing about the one question that matters most: is it over? The company said it blocked access from the suspected source as soon as it became aware of the intrusion and has put interim measures in place. But until the root cause is published, affected members should assume the data is circulating and act accordingly.

What you should do if you use the app

If you are a Burger King Japan app member, assume your name, phone number, email, and birth date are now known to criminals. Practical steps: be extra skeptical of any message claiming to be from Burger King, especially ones with links or QR codes. Do not reuse your Burger King app email and any related password on other accounts. Watch your accounts for password-reset attempts you did not trigger. And if a caller claims to be from Burger King and asks for personal details, hang up and contact the company through its official website instead.

One more note that applies far beyond Japan: a breach that leaks "only" contact details is still serious. The 11.18 million records here contain enough to personalize scams for years. Data does not expire the way news cycles do.

Frequently Asked Questions

What data was exposed in the Burger King Japan breach?

Names in kanji and katakana, phone numbers, email addresses, dates of birth, gender, prefecture of residence, membership IDs, mobile ordering history flags, and email verification status. Credit card numbers were not stored on the affected server, and no password leak has been confirmed.

When did the Burger King Japan breach happen?

Unauthorized access occurred between October 2 and October 7, 2026. The company confirmed the leak on October 13 after spotting signs of unauthorized access, and publicly disclosed it on October 15.

Should I worry if no passwords were leaked?

Yes. Phishing and social engineering attacks work best with accurate personal details, which is exactly what was exposed. Be wary of messages impersonating Burger King Japan, do not click unexpected links, and never enter personal information on pages you did not navigate to yourself.