Burger King Japan Says About 11.18 Million App Member Records Leaked After Unauthorised Access

The company that runs Burger King in Japan says personal data on about 11.18 million members of its official smartphone app has leaked after a third party gained unauthorised access to its systems.

BK Japan Holdings disclosed the breach in a Japanese-language notice on Thursday, 15 October 2026. The quotations below are TSN’s paraphrased translations of that notice.

What happened

According to the notice, the company found signs of possible unauthorised access by a third party to the system that manages member information for the official Burger King app. After investigating, it established on Tuesday, 13 October that unauthorised access had taken place between Friday, 2 October and Wednesday, 7 October 2026, and that member information had leaked.

The company says it blocked access from the source of the intrusion as soon as it confirmed the unauthorised access.

It also says that, as of the notice, it had not confirmed any secondary harm, such as fraudulent use of the leaked information.

What data was exposed

The notice lists approximately 11.18 million official app member records. The leaked information covers:

• member ID;
• email address;
• registration type;
• prefecture (the region of Japan the member lives in);
• gender;
• date of birth;
• full name, in both kanji and kana script;
• phone number;
• whether the member had any mobile-order history; and
• whether the member’s email address had been verified.

The company says it does not hold credit card numbers, so none were leaked. It also says a leak of login password information “has not been confirmed at present.” That wording means the company has not ruled it out yet; it has simply not found evidence of it so far.

What the company has done

BK Japan says it has already blocked communications from the source of the unauthorised access, put interim measures in place, set up a task force, and reported the incident to Japan’s Personal Information Protection Commission, the country’s data protection regulator.

It says it is still working on permanent fixes, carrying out investigations with outside specialists, and contacting affected customers by email. It also plans to strengthen its system security and monitoring, with advice from outside experts, to prevent a repeat.

What caused it

The company says it has confirmed the breach was caused by unauthorised third-party access, but how that access became possible, and the detailed cause, are still being investigated with outside specialists. It has not named an attacker or said how the intrusion happened.

Advice to customers

The notice warns customers to watch out for suspicious emails, text messages and phone calls that pretend to come from the company or its services. If they receive one, the company asks them not to click links, open attachments or enter member details or passwords.

The kind of data exposed, names with email addresses, phone numbers and dates of birth, is what phishers use to make fake messages look convincing, which is why that warning matters.

Part of a wider run of breaches in Japan

The disclosure is the latest in a string of data breaches at Japanese companies. Kyodo News reported that recent weeks have also brought breaches at the “Times Car” car-sharing service, East Japan Railway Co. and Yamaha Motor Co., and that travel agency H.I.S. said last week that customer passport information had been leaked late last year.

TSN has also reported on Ride On Express, which said data on up to about 6.5 million customers of its Gin no Sara delivery service may have leaked after a server attack.

What we don’t know

We don’t know who carried out the attack, how they got in, or whether login passwords were taken. The company has not said how many of the 11.18 million records belong to currently active app users.

What this means

• One of Japan’s larger recent leaks. About 11.18 million app member records were exposed, the company says.
• No card numbers, passwords unclear. Card numbers weren’t held; a password leak hasn’t been confirmed.
• Expect phishing. App members should be wary of messages claiming to be from Burger King Japan.

Sources

1. BK Japan Holdings, notice on leak of official app member information due to unauthorised access (Japanese), 15 October 2026. https://www.burgerking.co.jp/images/notice/2026/10/15/d4d114ca-ebd7-4f3d-94ef-c4ea7a84a139.pdf
2. Kyodo News, “Burger King’s Japan operator says 11.18 mil. customer records exposed”, 15 October 2026. https://english.kyodonews.net/articles/-/88323

Related stories

• Ride On Express Says Data on Up to About 6.5 Million Gin no Sara Customers May Have Leaked After a Server Attack
• Cyber Breaches: SoftBank Cloud Ransomware, Qilin’s 53 Japanese Victims, Asos’s Bigger Leak and Denmark’s Register