Burger King Japan: 11.18 million customer records exposed in breach

An intrusion in early October

Burger King Japan, the Japanese subsidiary of the fast-food chain, has reported that a server holding the data of 11.18 million customers of its official app was accessed without authorization. According to the company’s statement, relayed on 16 October 2026 by Bleeping Computer, the access took place between Friday 2 October and Wednesday 7 October 2026. The follow-up investigation was closed on 13 October. The statement, published on a Thursday, apologizes to the customers whose data was stolen earlier in the month and then published online.

App data, no bank card numbers

The affected servers stored information on users of the chain’s official mobile app: names, dates of birth, gender, email addresses, phone numbers and order history. According to the company, the database did not contain bank card numbers, and nothing shows that user credentials were accessed. Burger King Japan has reported the incident to the Personal Information Protection Commission and, with help from external cybersecurity experts, is continuing to analyze how the attackers gained access to the server.

This article rests on a single source: the Bleeping Computer report relaying the company’s statement. We have not been able to cross-check it against another independent source, so the facts above are attributed to the company.

What customers should do

According to the company, no secondary harm, such as fraudulent use, has been confirmed so far. That does not mean customers are safe. Names, phone numbers and email addresses, combined with an order history, are enough to write messages that look legitimate. Burger King Japan asks customers to be wary of emails, texts and calls that impersonate the brand. Do not click links or open attachments in such messages, and never enter your member information or password after such contact. If a message asks for these details in the chain’s name, the safest course is not to reply, and to go through the official app rather than a link you received.

One incident among others, and the lessons to draw

This case is not isolated. The source cites several major Japanese companies targeted since the start of the year, including KDDI, Nikkei, Keio and Sakura Internet. A researcher at Macnica counts 119 incidents of theft or exposure of personal data in Japan since the beginning of 2026. According to the researcher, attackers now probe websites and APIs for weaknesses in access control, configuration and authentication, and exploit vulnerabilities that are already known.

For a company that stores personal data, the first lesson is the least glamorous: knowing exactly what it keeps and why. Data that is not stored cannot leak, and an order history kept without any use is exposure with no benefit in return. The second is access control, including on APIs that are easy to forget when auditing, which matches the attack surface the researcher describes. Finally, updating components with known flaws closes some of the doors attackers already use. These measures are well known. They only protect if they are applied before an incident.

A loyalty app collects points, but it also collects its customers’ trust, and that is the first thing to be lost.