Burger King Japan app breach reached 11.18 million customer records over six days
Burger King Japan says attackers who accessed its app member system from Oct 2 to 7 reached 11.18 million customer records, and the data has leaked online. The company warned affected customers to watch for emails, SMS messages and calls that may impersonate it.
The Watch · Security desk
Timeline of three dates. October 2, 2026: unauthorized access to Burger King Japan's app member system begins. October 7, 2026: the access ends, with member information leaked. October 13, 2026: a follow-up investigation concludes and determines the unauthorized access occurred.
| Date | Event | Claim |
|---|---|---|
| October 2, 2026 | Unauthorized access to app member system begins | 2 |
| October 7, 2026 | Access ends; member information leaked | 2 |
| October 13, 2026 | Follow-up investigation determines access occurred | 3 |
What happened
- The exposed fields are names, dates of birth, gender, email addresses, phone numbers and order history for users of the official app.
- The company says no credit card numbers were stored on the server, and it has found nothing to show attackers got at user credentials.
- The company has notified Japan's Personal Information Protection Commission of the breach.
Why it matters
- Who's exposed exposure Every app member in the affected set can be approached by phone, email or SMS with accurate personal details, so impersonation is the near-term risk.
- What it costs cost Affected users carry the cost. The company's remedy is caution with unsolicited messages, and on its account there are no card numbers to replace.
- What it limits constraint The public record sizes the server at 11.18 million records but does not say how many were posted or where, so the extent of circulation cannot yet be measured from outside.
The company's own account fixes the timeline. It said it determined on Oct 13 that unauthorized access had occurred, which was 11 days after the first access date [3][16]. The access window itself ran six days [15]. "Upon becoming aware of the unauthorized access, we immediately blocked access from the source in question," Burger King Japan said [12].
We think order history is the field that matters most to an attacker. The records pair contact details with real purchase history [5], so a text that names the recipient and refers to an actual order looks like a Burger King notice. The company told customers to avoid clicking URLs, opening attachments or entering member information or passwords in suspect messages [9]. It added: "At this time, no secondary damage, such as fraudulent use, resulting from this incident has been confirmed." [8]
The entry route is still being investigated, with help from external cybersecurity experts [14]. Macnica researcher Yutaka Sejiyama has logged 119 incidents this year involving personal information theft or exposure [10]. He found attackers probing websites and APIs for weak access controls, misconfigurations and authentication flaws, and exploiting n-day vulnerabilities that were already known [11]. BleepingComputer lists Nikkei, Keio and KDDI among other Japanese companies hit this year [13].
Until Burger King Japan says how the attackers got in, we would not place this intrusion under any of those methods.
What to watch
- Whether Burger King Japan and its outside experts publish the entry route, which would show whether this fits the web and API probing Sejiyama describes.
- Any confirmed fraudulent use of the data. The company said none had been confirmed as of its release.
- Any follow-up from Japan's Personal Information Protection Commission after the company's report.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap−5
- Incentives
- Not scored
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Burger King Japan disclosed a data breach after attackers accessed a server containing 11.18 million customer records.
- [2]
Burger King Japan said unauthorized access to the system that manages member information for its official app occurred between Friday, October 2, 2026, and Wednesday, October 7, 2026, resulting in a leak of member information.
- [3]
Burger King Japan concluded a follow-up investigation on October 13 and determined on Tuesday, October 13, 2026, that the unauthorized access had occurred.
- [4]
Burger King Japan apologized to customers whose data was stolen in early October and leaked online.
- [5]
The breached servers stored personal information for users of the company's official smartphone app, including names, dates of birth, gender, email addresses, phone numbers and order history.
- [6]
Burger King Japan says the compromised server did not store customer credit card numbers and that it found no evidence that the threat actors accessed user credentials.
- [7]
Burger King Japan has reported the breach to Japan's Personal Information Protection Commission (PPC).
- [8]
"At this time, no secondary damage, such as fraudulent use, resulting from this incident has been confirmed."
- [9]
Burger King Japan warned affected customers to watch for suspicious emails, SMS messages and phone calls that may impersonate Burger King Japan, and to avoid clicking URLs, opening attachments, or entering member information or passwords.
- [10]
Macnica researcher Yutaka Sejiyama has logged 119 cybersecurity incidents involving personal information theft or exposure this year.
- [11]
Sejiyama found that attackers are now probing websites and APIs for access-control, configuration and authentication weaknesses, and exploiting known (n-day) vulnerabilities.
- [12]
"Upon becoming aware of the unauthorized access, we immediately blocked access from the source in question."
- [13]
Cyberattacks have hit several major Japanese companies since the start of the year, including Daiichi Kosho, IDC Frontier, Nikkei, Keio, Times Car, Sakura Internet, Nihon Kotsu and KDDI.
- [14]
Burger King Japan is investigating how the attackers accessed the compromised server, with help from external cybersecurity experts.
- [15]
The access window, October 2 to October 7, spans six days counting both end dates.
- [16]
The October 13 determination came 11 days after the first access date of October 2.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- bleepingcomputer.comBurger King Japan data breach exposes 11 million customer records
1 article · October 16, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Japan CybersecurityFollow
- Phishing and Social Engineering RiskFollow
- Data BreachesFollow
Entities
- Personal Information Protection CommissionFollow
- Burger King JapanFollow
- BleepingComputerFollow
- Yutaka SejiyamaFollow
- MacnicaFollow