Burger King Japan confirms data breach of 11.18 million records

Burger King Japan has confirmed a data breach involving approximately 11.18 million member records from its official mobile application. The unauthorized access occurred between October 2 and October 7, 2026, and was confirmed by the company on October 13.

The exposed information includes member IDs, email addresses, registration types, prefectures, gender, dates of birth, full names in kanji and kana, and phone numbers. The leak also includes data regarding whether members used mobile ordering and if their email addresses were verified.

BK Japan stated that it does not store credit card numbers, so financial details were not part of the leak. While the company noted that no leak of login passwords has been confirmed so far, it has warned customers to be vigilant against potential phishing attempts via email or phone.

The company has blocked the unauthorized access, notified Japan’s Personal Information Protection Commission, and is working with external experts to investigate the cause and prevent recurrence.