Burger King Japan Data Breach Exposes Personal Details of 11 Million App Members
Burger King Japan has disclosed that an unauthorized party accessed its membership system between 2 and 7 October 2026, exposing the personal data of roughly 11.18 million users of its official app. Security Affairs reports that the company confirmed the leak on 13 October and published a notice on 15 October.
According to that report, the exposed fields include membership IDs, email addresses, names in Japanese characters and kana, phone numbers, dates of birth, gender, prefecture of residence and membership registration type, along with flags showing whether a user has mobile-ordering history and a verified email. The company says it does not store credit card numbers and has found no evidence that passwords were exposed, and it reports no confirmed cases of fraud so far.
Burger King Japan has not said how the intruder got in or who is responsible. It says it blocked the source of the activity, put temporary countermeasures in place, formed an incident response team with outside security specialists and reported the incident to Japan’s Personal Information Protection Commission. Customers are being notified by email and warned to be cautious of suspicious emails, text messages and calls that could exploit the leaked contact details. Other outlets have reported a separate supply-chain breach at Japanese karaoke operator Daiichi Kosho affecting more than eight million customers the same week (Infosecurity Magazine), underscoring pressure on consumer-data holders in Japan. Details of the Burger King Japan incident may change as the investigation continues.