Short answer
BK Japan said unauthorized access to a server holding data on users of its official smartphone app took place from 2 to 7 October 2026, and that member information leaked. It counts about 11.18 million records and says it does not store credit card numbers.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | BK Japan (Burger King Japan) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Restaurants and food service |
| Country | Japan |
| Detected | 2026-10-13 |
| Disclosed | 2026-10-15 |
| People or records affected | About 11.18 million app member records, as counted by the company (not a confirmed number of unique people) |
What data was exposed
- Names (kanji and kana), email addresses and phone numbers
- Dates of birth, gender and prefecture
- Member IDs and registration type
- Whether a member had mobile ordering history and whether an email address was verified
What happened
BK Japan, which operates about 350 Burger King restaurants in Japan, announced on 15 October 2026 that a server holding data on users of its official smartphone app had been accessed without authorization. According to the company, the access took place from 2 to 7 October, and on 13 October its investigation established that member information had leaked. BleepingComputer reported the announcement the next day.
The company counts about 11.18 million records. It has not said how many unique people that covers, so the figure may include duplicates.
What data was involved
Reporting based on the company’s notice lists the following fields:
- Names in kanji and kana
- Email addresses and phone numbers
- Dates of birth and gender
- Prefecture and member IDs
- In some coverage, registration type, whether the email address was verified, and whether a member had mobile ordering history (presence only, not what was ordered)
BK Japan says the server did not hold credit card numbers. It has not confirmed any leak of login passwords, and coverage describes that question as still under investigation.
What the company has done
BK Japan says it blocked access from the source of the connections, set up an incident response team and reported the breach to Japan’s Personal Information Protection Commission. It is working with external experts to find how the attacker got in, a detail it has not disclosed. It apologized to customers and said no fraud or other secondary harm had been confirmed when it made the announcement. It also plans to email affected customers.
BleepingComputer noted that the incident came amid a run of attacks on Japanese companies this year and cited Macnica researcher Yutaka Sejiyama, who has logged 119 incidents involving personal information theft or exposure in 2026. The same article says attackers are probing websites and APIs for access-control and configuration weaknesses, but BK Japan has not said that is how it was breached.
Why this matters for scams
Names, phone numbers, birth dates and email addresses are what fraudsters need to build a believable message. SOCRadar’s Ensar Seker, quoted by Hackread, warned of fake “secure your account” pages impersonating Burger King support. That is a plausible risk, not a campaign anyone has reported. BK Japan itself told customers to be wary of emails, texts and calls impersonating the chain and not to enter member information in response.
The safe habit is simple: never use a link in a message to reach your account. Open the app or type the site address yourself.
Related reading
Our data breach checklist covers password changes and monitoring, and the guide to phishing messages shows the signs of a fake account alert. Another large membership leak from Japan is covered in the CAPCOM ID breach.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails or SMS messages posing as Burger King Japan that ask you to log in, verify your account or claim a coupon.
- Calls from people who quote your name, phone number or birth date to sound legitimate.
- Fake 'secure your account' pages that copy the app's look and ask for passwords or verification codes.
What to do if you are affected
- 01Do not tap links or open attachments in messages that claim to be from Burger King Japan. Open the app or the official site directly.
- 02Never enter your password or a one-time code in response to an email, text or call.
- 03Change your app password, and any account where you reuse it, as a precaution.
- 04Treat callers who know your birth date or phone number as unverified until you confirm through an official channel.
- 05Watch for the company's email notice to affected customers and check that it comes from a genuine Burger King Japan address.
Frequently asked questions
When did the Burger King Japan breach happen?
BK Japan says unauthorized access took place from 2 to 7 October 2026. It determined on 13 October that member information had leaked and announced the incident on 15 October.
Were credit card numbers or passwords exposed?
BK Japan says it does not store credit card numbers on the affected server. It has not confirmed any leak of login passwords, though coverage notes this was still being investigated.
How was the server breached?
The company has not said how the attacker got in. It is working with outside security specialists to find the cause.
Has the data been used for fraud?
At the time of the announcement, BK Japan said it had confirmed no secondary harm such as fraudulent use. It reported the incident to Japan's Personal Information Protection Commission.
Sources
- Burger King Japan data breach exposes 11 million customer records, BleepingComputer, 2026-10-16
- Burger King Japan data breach exposes 11.18 million app member records, CyberInsider, 2026-10-16
- Burger King Japan Data Breach Affects 11.18 Million App Members, Hackread, 2026-10-16
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.