Burger King Japan app breach exposes approximately 11.18 million membership records
Attackers accessed Burger King Japan’s app membership system on 2–7 October, exposing about 11.18 million records. Card numbers were not held there; password leakage was not confirmed. Watch for impersonation emails, texts and calls.
If you used Burger King Japan’s official app, watch for emails, texts or calls impersonating the company. Do not open suspicious links or attachments or provide membership details or passwords; check any notice through the official app or website directly. There is no customer software patch identified for this breach.
What’s happening
Burger King Japan disclosed on 15 October that attackers had accessed its official app’s membership system between 2 and 7 October, exposing approximately 11.18 million records. This is a record count, not a confirmed number of individual people. Exposed fields included membership IDs, names, birth dates, gender, email addresses, phone numbers, prefectures, registration types and email-verification status. The company’s statement lists whether a mobile-order history exists; BleepingComputer describes order histories more broadly. The company did not hold payment-card numbers in the affected system and had not confirmed password leakage or resulting fraudulent use when it announced the incident. It blocked the access source, introduced interim measures, reported to Japan’s privacy regulator and began emailing affected members. External specialists were investigating the cause while permanent measures continued. A review updated on 30 October found no second company notice. No later development was found in the search through 3 November, so a completed investigation or full remediation cannot be confirmed.
- What
- Breach
- Affects
- Burger King Japan official app membership service
- Fixed in
- Nothing to patch
- Since
- 2 Oct 2026
Timeline
- Update
Westeria’s updated review reported that it had found no second company notice. The entry method remained undisclosed, and the company had not publicly confirmed completion of its investigation or permanent measures.
- Made publicNothing to patch
Burger King Japan disclosed approximately 11.18 million exposed membership records and said affected customers were being notified by email. It had reported the incident to Japan’s Personal Information Protection Commission; investigation and permanent security measures were continuing.
- Update
The investigation confirmed that membership information had leaked. Burger King Japan said it blocked the source of the unauthorised access immediately after becoming aware of it, without specifying the blocking date.
- Update
Unauthorised access to Burger King Japan’s app membership system began. The company later identified the access period as 2–7 October.
Sources
- Official notice index listing the app membership data breach announcementBurger King Japan · 15 Oct 2026
- Burger King app breach: company statement reproduced by ABEMA; original PDF could not be retrievedABEMA · 15 Oct 2026
- Burger King Japan data breach exposes 11 million customer recordsBleepingComputer · 16 Oct 2026
- Burger King official app: approximately 11.18 million membership records leaked through unauthorised accessINTERNET Watch · 15 Oct 2026
- Burger King official app information leak: affected data and member advice, updated 30 OctoberWesteria · 30 Oct 2026