16 OCT 2026 — Burger King Japan says attackers took personal details on about 11.18 million members of its smartphone app. Six weeks earlier the company had celebrated the app passing 10 million members, which suggests the breach reached nearly the entire membership. BK Japan disclosed the leak on 15 October, two days after confirming it.
The breach is the latest in a run of large breaches at Japanese consumer companies this autumn. BK Japan says it does not yet know how the attackers got in.
What was taken
BK Japan's notice to customers, published in Japanese, says the leaked records include member IDs, email addresses, names in kanji and katakana, phone numbers, dates of birth, gender and prefecture. The records also show whether each member had used mobile ordering and whether their email address was verified.
The company says it does not hold credit card numbers, so none leaked. It says a leak of login passwords "has not been confirmed at present", which stops short of ruling one out. It has found no fraudulent use of the data so far.
How it unfolded
The company first spotted signs of possible unauthorised access to the system that manages app member data. Its investigation traced the intrusion to a six-day window from 2 to 7 October, and by 13 October it had confirmed that member information had left the company. In the meantime it cut off the attackers' access and formed a task force, and it has since reported the incident to the Personal Information Protection Commission, Japan's privacy regulator. Affected customers are being told by email.
BK Japan still cannot say how the attackers got in. The notice says the cause is still being examined with external specialists. It does not name an attacker or say whether ransom was demanded.
Almost the whole app base
On 3 September, BK Japan announced a promotion to mark its official app passing 10 million members, according to the company's news page. Losing about 11.18 million records weeks later implies the exposed system held almost every account, and possibly some older or inactive ones. The company has not said how many of the records belong to current members.
Names, birth dates and phone numbers in one dataset are well suited to fraud. BK Japan has warned customers to be wary of emails, text messages and calls pretending to come from the company, and not to click links, open attachments or enter passwords in response to them.
Part of a wider wave
Kyodo News lists the breach among recent incidents at Japanese companies, including the Times Car car-sharing service, East Japan Railway and Yamaha Motor. Travel agency H.I.S. said last week that customer passport information had leaked late last year. Japanese breach reporting was already near record levels before this wave: 19,417 reports in the 2025 fiscal year, the second-highest total on record.
What app users should do
The biggest risk for app users is now the follow-up contact rather than the breach itself. A caller or message that recites a member's name and birth date can sound convincing, which is exactly what makes leaked data like this useful to scammers. Anyone who reused their Burger King password on another service should change it there too. Our password strength tester shows how quickly a reused or simple password can be guessed.
View author profile → · Editorial policy
