Burger King Japan says unauthorised access exposed 11.18 million app member records

TLDR

• Burger King Japan said on 15 October that 11.18 million app member records were exposed through unauthorised server access.¹
• Exposed data includes names, birth dates, email addresses and phone numbers, but not credit card numbers, the company says.¹²
• BleepingComputer's claim that the data was "leaked online" is not backed by the company statement it quotes.²

Kyodo News reported on 15 October that the operator of the Burger King chain in Japan became the latest Japanese company to disclose a data breach, with 11.18 million customer records exposed through unauthorised access to the server that manages data from its official smartphone app.¹ BleepingComputer, quoting the company's statement, says the access took place between 2 and 7 October and was determined to have caused a leak of member information on 13 October.² Cybernews, citing the notice on the company's website, gives the same dates as the point at which the attackers had access to the app's backend.³

The sources differ slightly on what was exposed. Kyodo lists names, dates of birth, email addresses, phone numbers and gender.¹ BleepingComputer adds order history.² Cybernews lists member ID, name in kanji and kana, phone number, date of birth, gender, prefecture of residence and registration type, and does not mention order history.³ On credentials, BleepingComputer says the company found no evidence that the attackers accessed user credentials, while Cybernews says the company has not confirmed that login passwords were leaked.²³ Affected members are being notified individually by email, according to Cybernews.³

BleepingComputer says the company has reported the breach to Japan's Personal Information Protection Commission, is investigating how the attackers got in with outside experts, and has warned customers to watch for emails, SMS messages and calls impersonating it.²³ No secondary damage has been confirmed so far.²

BleepingComputer's opening paragraph says the data was stolen in early October and "leaked online", but the company statement it quotes refers only to a leak of member information, and none of the other sources say the data has been published.² That claim should be treated as unconfirmed.

BleepingComputer places the incident in a run of attacks on large Japanese companies this year, and cites Macnica researcher Yutaka Sejiyama as having logged 119 incidents involving personal information theft or exposure so far in 2026, with attackers probing websites and APIs for access-control, configuration and authentication weaknesses and exploiting known vulnerabilities.²

Why it matters: the exposed fields (name, date of birth, phone number and email address) are the kind of details used to make impersonation emails and calls convincing, which is why the company is telling members to ignore links and attachments in unexpected messages.²³