Burger King Japan: about 11.18 million app member records taken
BK Japan said attackers accessed the system managing its official app members from October 2 to 7, 2026 and took data on about 11.18 million members, including names, phone numbers, email addresses and dates of birth.
What happened
BK Japan, which operates Burger King in Japan, said an outside party gained unauthorised access between October 2 and 7, 2026 to the system that manages member information for its official app, and that member data was taken. The company confirmed the leak on October 13 after investigating signs of unauthorised access, and announced it on October 15. It says it blocked the source of the access, put interim measures in place, set up a response headquarters and reported the incident to Japan's Personal Information Protection Commission; how the attackers got in is still under investigation with outside specialists, and no misuse of the data has been confirmed so far.
Who is affected
About 11.18 million member records were taken — BK Japan has not said how many individual people that represents. The data includes member IDs, full names in kanji and kana, phone numbers, email addresses, dates of birth, sex, prefecture, registration type, whether the email address had been verified, and whether the member had used mobile ordering. BK Japan says it does not hold credit card numbers, so those were not taken, and it says a leak of login passwords has not been confirmed at this time. The company is emailing affected members.
How serious
The concrete risk is targeted phishing and impersonation: a name, phone number, email address and date of birth together let a scammer pose as Burger King — a fake refund, coupon or account-problem message, or a call that cites real details to win trust — and steer the victim to a false sign-in page or a payment request. Card numbers were not held, and a password leak is unconfirmed, so the confirmed danger is deception using the taken details rather than direct access to members' accounts or cards.
What to do now
If you have a Burger King Japan app account, treat unexpected emails, texts and calls claiming to be from Burger King as suspect: open the official app or type the company's address yourself instead of following a message link, and never share a password, verification code or payment details in response to unsolicited contact. If you entered your password on a suspicious page, change it there and anywhere else you reused it.
Sources: Japan Cyber Watch · Cyber Security News