{"id":"burger-king-japan-app-breach-oct-2026","category":"breach","status":"live","title":"Burger King Japan app breach exposes approximately 11.18 million membership records","tldr":"Attackers accessed Burger King Japan’s app membership system on 2–7 October, exposing about 11.18 million records. Card numbers were not held there; password leakage was not confirmed. Watch for impersonation emails, texts and calls.","summary":"Burger King Japan disclosed on 15 October that attackers had accessed its official app’s membership system between 2 and 7 October, exposing approximately 11.18 million records. This is a record count, not a confirmed number of individual people. Exposed fields included membership IDs, names, birth dates, gender, email addresses, phone numbers, prefectures, registration types and email-verification status. The company’s statement lists whether a mobile-order history exists; BleepingComputer describes order histories more broadly. The company did not hold payment-card numbers in the affected system and had not confirmed password leakage or resulting fraudulent use when it announced the incident. It blocked the access source, introduced interim measures, reported to Japan’s privacy regulator and began emailing affected members. External specialists were investigating the cause while permanent measures continued. A review updated on 30 October found no second company notice. No later development was found in the search through 3 November, so a completed investigation or full remediation cannot be confirmed.","action":"If you used Burger King Japan’s official app, watch for emails, texts or calls impersonating the company. Do not open suspicious links or attachments or provide membership details or passwords; check any notice through the official app or website directly. There is no customer software patch identified for this breach.","product":"Burger King Japan official app membership service","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["burger-king","japan","data-breach","personal-data","mobile-app"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Official notice index listing the app membership data breach announcement","url":"https://www.burgerking.co.jp/notice/list","by":"Burger King Japan","date":"2026-10-15"},{"kind":"news","title":"Burger King app breach: company statement reproduced by ABEMA; original PDF could not be retrieved","url":"https://abema.tv/video/episode/89-93_s100_p603","by":"ABEMA","date":"2026-10-15"},{"kind":"news","title":"Burger King Japan data breach exposes 11 million customer records","url":"https://www.bleepingcomputer.com/news/security/burger-king-japan-data-breach-exposes-11-million-customer-records/","by":"BleepingComputer","date":"2026-10-16"},{"kind":"news","title":"Burger King official app: approximately 11.18 million membership records leaked through unauthorised access","url":"https://internet.watch.impress.co.jp/docs/news/2148458.html","by":"INTERNET Watch","date":"2026-10-15"},{"kind":"post","title":"Burger King official app information leak: affected data and member advice, updated 30 October","url":"https://westeria.jp/security-incidents/cases/bk-japan-2026/","by":"Westeria","date":"2026-10-30"}],"started":"2026-10-02","closed":null,"created":"2026-11-03T21:37:51.260Z","updated":"2026-11-03T21:37:51.260Z","cve_notes":[],"timeline":[{"at":"2026-10-30","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"Westeria’s updated review reported that it had found no second company notice. The entry method remained undisclosed, and the company had not publicly confirmed completion of its investigation or permanent measures.","url":"https://westeria.jp/security-incidents/cases/bk-japan-2026/","by":"Westeria","patch":null},{"at":"2026-10-15","added":"2026-11-03T21:35:43.306Z","kind":"disclosed","text":"Burger King Japan disclosed approximately 11.18 million exposed membership records and said affected customers were being notified by email. It had reported the incident to Japan’s Personal Information Protection Commission; investigation and permanent security measures were continuing.","url":"https://abema.tv/video/episode/89-93_s100_p603","by":"ABEMA, reproducing BK Japan’s statement","patch":"na"},{"at":"2026-10-13","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"The investigation confirmed that membership information had leaked. Burger King Japan said it blocked the source of the unauthorised access immediately after becoming aware of it, without specifying the blocking date.","url":"https://abema.tv/video/episode/89-93_s100_p603","by":"ABEMA, reproducing BK Japan’s statement","patch":null},{"at":"2026-10-02","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"Unauthorised access to Burger King Japan’s app membership system began. The company later identified the access period as 2–7 October.","url":"https://internet.watch.impress.co.jp/docs/news/2148458.html","by":"INTERNET Watch","patch":null}],"url":"https://hard.fyi/live/burger-king-japan-app-breach-oct-2026/","json":"https://hard.fyi/api/live?id=burger-king-japan-app-breach-oct-2026"}