Burger King Japan
ModerateReportedRetail
Burger King Japan announced that an unauthorized third party accessed the system managing member accounts for its official mobile app between 2 and 7 October 2026, resulting in a data leak. On 13 October 2026 its investigation determined that member information had been leaked; trade press reports 11.18 million customer records. The data concerned includes names, dates of birth, gender, email addresses, phone numbers and order history. The company states the server did not hold credit card numbers, that no access to login credentials was found, and that no fraudulent use has been confirmed so far; it warns about emails, SMS messages and calls impersonating the company.
Identity and contact details of this kind let a malicious third party run phishing or fraud campaigns by email, SMS or phone while impersonating the brand, using personal details and order history to appear credible.
- Disclosed on
- October 15, 2026
- Incident dated
- October 2, 2026
- Sector
- Retail
- Country
- Japan
- Cause
- Undisclosed
Exposed data
- Full name
- Date of birth
- Email address
- Phone number
- Order history
- Other personal data
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact