Burger King Japan Data Breach Exposes 11.18 Million Customer Records

Burger King Japan has disclosed a major data breach after attackers accessed servers containing information associated with 11.18 million customer records.

The compromised servers stored personal information belonging to users of Burger King Japan’s official smartphone app, including names, dates of birth, gender, email addresses, phone numbers, and order history.

Burger King Japan confirms unauthorized access

Burger King Japan, the Japanese subsidiary of global fast-food company Burger King, announced in a press release Thursday that it completed a follow-up investigation on October 13. The company apologized to customers whose information was stolen and leaked online in early October.

Founded in Florida in 1953, Burger King is now a multinational fast-food chain with approximately 20,000 locations worldwide, including 350 locations in Japan.

Burger King Japan said it identified the possibility of unauthorized third-party access to the system managing member information for its official app.

“As a result, it was discovered that unauthorized access occurred between October 13, 2026 (Tuesday), October 2, 2026 (Friday), and October 7, 2026 (Wednesday), and member information was leaked. Upon becoming aware of the unauthorized access, we immediately blocked access from the source in question.”

No credit card numbers or credentials stored on affected servers

The company said that customer credit card numbers were not stored on the compromised servers. Burger King Japan also said it found no evidence that attackers accessed user credentials.

Burger King Japan has reported the incident to Japan’s Personal Information Protection Commission (PPC). It is working with outside cybersecurity experts to determine how the attackers gained access to the affected servers.

“We sincerely apologize for the great inconvenience and concern this situation has caused to our customers and related parties.” The company added that, at this time, it has not confirmed any secondary damage, such as unauthorized use of the stolen information.

Burger King warns customers about phishing attempts

Burger King Japan warned affected customers to be cautious of suspicious emails, SMS messages, and phone calls impersonating the company. Customers should avoid clicking links, opening attachments, or entering membership information and passwords in response to unexpected messages.

Japan faces a growing wave of cyberattacks

The Burger King Japan breach adds to a wave of cyberattacks affecting major Japanese companies since the beginning of the year. Other impacted organizations include entertainment systems maker Daiichi Kosho, cloud and digital infrastructure company IDC Frontier, Japanese publishing giant Nihon Keizai Shimbun, private railway operator Keio Electric Railway, car-sharing service Times Car, cloud and data center provider Sakura Internet, taxi operator Nippon Kotsu, and telecommunications giant KDDI.

Macnica researcher Yutaka Sechiyama said that 119 cybersecurity incidents were recorded. This year has seen an increase in incidents involving identity theft and data leaks, with attackers probing weaknesses in website and API access controls, configuration, and authentication. Attackers are also exploiting known, or “n-day,” vulnerabilities.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop dramatically.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report