Burger King Japan has disclosed unauthorized access to the system that manages membership information for its official smartphone app, potentially exposing approximately 11.18 million records.
According to Security Affairs’ account of the company notice, the unauthorized access occurred between 2 October and 7 October 2026. A follow-up investigation confirmed the leak on 13 October, and Burger King Japan published its notice on 15 October.
The figure refers to membership records and does not establish that 11.18 million unique people were affected. The available reports also do not show that every potentially exposed record was copied or exfiltrated.
Membership and contact details were at risk
The affected information may include:
- Membership IDs
- Email addresses
- Names written in Japanese characters and kana
- Phone numbers
- Dates of birth
- Gender
- Prefecture of residence
- Membership registration type
- Whether the member has a mobile-ordering history
- Whether the email address has been verified
The mobile-ordering field appears to indicate whether a customer has used that function, rather than providing a complete history of individual purchases.
Burger King Japan said credit card numbers were not stored on the affected server. It also reported finding no evidence that passwords or other user credentials were accessed.
The company had not confirmed fraudulent use or other secondary harm when it issued the notice. That does not eliminate the risk that exposed contact and profile data could later be used to make phishing attempts more convincing.
Access method remains under investigation
Burger King Japan characterized the incident as unauthorized third-party access but has not disclosed the initial access vector or attributed the activity to a named threat actor.
The company said it blocked access from the source of the unauthorized activity after becoming aware of it. It also notified Japan’s Personal Information Protection Commission and brought in external cybersecurity specialists to investigate how the server was accessed.
Temporary countermeasures have been implemented, while an incident response team is working on further investigation and permanent security improvements. Email notifications to affected customers are also underway, according to the reported notice.
BleepingComputer reported that the data was leaked online, but its report did not identify where it appeared or provide evidence of public distribution.
Customers should watch for impersonation attempts
Burger King Japan advised app members to be cautious of emails, SMS messages and phone calls that claim to come from the company. In particular, customers should not follow unexpected URLs, open unsolicited attachments, or submit membership information or passwords in response to such messages.
Because the potentially exposed fields include names, contact details and membership-related information, fraudulent messages could contain accurate personal details. Those details alone should not be treated as proof that a message or caller is legitimate.
