Burger King Japan data breach exposes 11 million customer records

Between October 2 and October 7, 2026, unauthorized third-party actors accessed a server managing member information for Burger King Japan's official app, resulting in the exposure of 11.18 million customer records. The leaked data includes personal identifiers and order history but excludes credit card details and user credentials. Upon discovery, the company immediately blocked the source of unauthorized access and initiated an investigation with external cybersecurity experts. The breach has been reported to Japan's Personal Information Protection Commission. Burger King Japan has warned customers to watch for phishing attempts and has not confirmed any fraudulent use stemming from this incident.

The breach exposed sensitive personal information of over 11 million customers, including names, birth dates, gender, email addresses, phone numbers, and order histories. Although no credit card data or user credentials were compromised, the exposed data could facilitate phishing, social engineering, or identity-related fraud attempts. No secondary damages such as fraudulent use have been confirmed at this time.

Burger King Japan has blocked the unauthorized access source and is investigating the breach with external cybersecurity experts. The company has reported the incident to the Personal Information Protection Commission of Japan. Customers are advised to remain vigilant against suspicious emails, SMS messages, and phone calls impersonating Burger King Japan and to avoid clicking on suspicious links or providing personal information. No additional immediate action is indicated by the vendor at this time.