Burger King Japan Breach: 11.18M Records Leaked [2026]

Burger King Japan has confirmed a data breach that exposed roughly 11.18 million records tied to members of its official smartphone app, making it one of the largest consumer data incidents reported out of Japan this year. The operator, BK Japan, disclosed the breach on October 15, 2026, after an outside party gained unauthorized access to the system that manages app member information between October 2 and October 7, 2026.

The Burger King Japan data breach did not expose credit card numbers, according to the company, which said it does not retain that data in the first place. No login password exposure has been confirmed either. But the records that were taken, including names, phone numbers, email addresses, birth dates, and prefecture of residence, give attackers more than enough raw material to run convincing phishing and impersonation campaigns against millions of app users across the country.

Security outlet Bleeping Computer reported the breach hit servers tied to the company’s official app, while Cybernews and Cyber Security News both independently confirmed the 11.18 million figure based on BK Japan’s own public notice. The incident adds Burger King’s Japanese operation to a growing list of household consumer brands forced to disclose breaches touching tens of millions of customer records in 2026.

Google · Preferred Sources

Don't miss new tech stories on Google

Add TrendinTech once in the Google app and our stories appear in your news suggestions.

Add Now

Timeline: From October 2 Intrusion to October 15 Disclosure

The sequence of events behind the Burger King Japan data breach spans about two weeks. BK Japan says the unauthorized access began October 2, 2026 and continued until October 7, 2026, a five day window in which an outside party was inside the system managing official-app member information. The company says it only confirmed the possibility of unauthorized access and launched an internal investigation on October 13, six days after the intrusion window closed.

Two days later, on October 15, 2026, BK Japan published a formal notice acknowledging that approximately 11.18 million official-app member records had been leaked. That notice, posted directly to the company’s corporate site, triggered a wave of coverage from Japanese and international outlets within hours.

Date	Event
October 2, 2026	Unauthorized access to the app member database begins
October 7, 2026	Unauthorized access window closes
October 13, 2026	BK Japan confirms the possibility of a breach and opens an internal investigation
October 15, 2026	BK Japan publishes its public notice confirming 11.18 million exposed records
October 15 to 16, 2026	Bleeping Computer, Cybernews, MLex and other outlets report on the disclosure
Ongoing	Incident reported to Japan’s Personal Information Protection Commission

That eight day gap between the end of the intrusion and public disclosure is not unusual for breach investigations, which typically require forensic review before a company can state with confidence what was taken. Still, it means millions of app users went nearly two weeks without knowing their personal data may have been circulating outside BK Japan’s systems.

What Information Was Exposed

BK Japan’s notice lists a specific set of data fields confirmed as part of the leak. Understanding exactly what left the building, and what reportedly did not, matters for anyone trying to gauge their personal exposure.

Data Confirmed Compromised

Member ID numbers tied to official app accounts
Email addresses
Registration type (how the account was created)
Prefecture of residence
Gender
Date of birth
Full name in both kanji and kana script
Telephone numbers
Whether a mobile order history exists on the account
Whether the account’s email address had been verified

Data the Company Says Was Not Taken

BK Japan says credit card numbers were not leaked, because the company does not retain that data on its own servers in the first place, a detail confirmed by both the company’s notice and subsequent reporting. No confirmed leak of login passwords has been reported either. That distinction matters: a breach of names, birth dates, phone numbers, and email addresses is bad, but it is not the same severity as a breach that also hands attackers stored payment credentials or account passwords that might be reused elsewhere.

It is worth being precise about one nuance in the official figure. BK Japan’s notice describes approximately 11.18 million affected records, which is not necessarily identical to 11.18 million unique individuals, since some users may hold more than one record or account. The company has not broken down the figure further as of this writing.

How BK Japan Discovered and Verified the Breach

According to the company’s own account, reported by Internet Watch, BK Japan first identified the possibility of unauthorized access to its app member database and launched an investigation on October 13, 2026. That investigation traced the intrusion back to the October 2 to October 7 window and confirmed that member records had, in fact, left the system during that period.

The company has not detailed the technical vector used to gain access, nor has it named any threat actor or group behind the intrusion. That lack of technical detail is common in early breach notices filed under Japanese disclosure norms, which tend to prioritize notifying affected users and regulators over publishing forensic specifics that could still be under investigation.

The pattern mirrors other recent enterprise intrusions where attackers sat inside a system for days before exfiltrating data, a tactic also seen in the chained vulnerability exploitation detailed in TrendinTech’s coverage of the Ivanti Connect Secure zero-day that let attackers escalate from an initial foothold to root-level access. Dwell time, the gap between initial compromise and detection, remains one of the most persistent weaknesses in consumer-facing platform security.

Burger King Japan’s Official Apology and Response

In its public statement, Burger King Japan said, “We deeply apologize for the significant inconvenience and concern this incident has caused,” according to News On Japan‘s report on the disclosure. The apology accompanied the formal notice acknowledging the scope of the breach and the specific data fields involved.

Beyond the apology, BK Japan’s public messaging has focused on two reassurances: that payment card numbers were never at risk because the company does not store them, and that no fraudulent use of the leaked information has been confirmed as of the disclosure date. Neither point eliminates risk for the 11.18 million affected records, but both narrow the immediate threat compared to a breach involving financial credentials directly.

The company has not yet detailed what remediation steps, such as mandatory password resets or enhanced monitoring, it plans to roll out for affected app users. Companies handling breaches of this scale in Japan typically follow up initial notices with more detailed guidance once the regulatory review process is further along.

Regulatory Reporting to Japan’s Personal Information Protection Commission

BK Japan reported the incident to Japan’s Personal Information Protection Commission, the country’s primary data protection regulator, according to coverage from MLex. The commission oversees enforcement of Japan’s Act on the Protection of Personal Information, which requires companies to report breaches affecting a significant number of individuals and to notify affected users.

Japan’s data protection framework has tightened substantially over the past several years, with amendments that raised reporting obligations and expanded the commission’s investigative authority. A breach of this scale, spanning more than 11 million records, is likely to draw sustained regulatory attention even without evidence of financial fraud, simply because of the volume of personal data involved and the sensitivity of fields like full legal names and dates of birth.

How the commission responds, whether through a formal advisory, a corrective order, or a quieter compliance review, will likely shape how other Japanese consumer app operators handle their own security postures heading into 2027.

Why Loyalty App Databases Are a Growing Target

Fast food loyalty and ordering apps sit on an unusual combination of data: real names, verified phone numbers, birth dates, precise location data in the form of prefecture or delivery address, and behavioral signals like order history. None of that is as immediately monetizable as a stolen credit card number, but all of it is extremely useful for building convincing phishing lures, SIM-swap attempts, or account takeover attacks against other services where the same person reused their phone number or email as a login.

Attackers increasingly treat these mid-tier consumer databases as enrichment data rather than a standalone payday. A record that pairs a verified phone number with a real name, birth date, and gender is far more useful for crafting a targeted smishing message than a password dump alone, because it lets scammers reference specific, correct personal details that make a fraudulent message look legitimate.

This is the same dynamic that made the Denmark national breach involving 8.8 million records so damaging even though the exposed credential itself was trivially weak. The value of the leaked dataset is not just what one record reveals, it is what a dataset of 11 million records lets an attacker automate at scale.

Historical Context: Japan’s 2026 Data Breach Wave

The Burger King Japan data breach lands in the middle of a year that has already produced a string of large consumer-data incidents across multiple sectors and regions. Japan in particular has seen a rise in breach disclosures tied to consumer app platforms, as more retail and restaurant chains moved loyalty and ordering functions into centralized mobile systems that aggregate personal data at a scale previous point-of-sale systems never approached.

Globally, 2026 has brought a steady drumbeat of similarly structured incidents. The UK Legal Aid Agency breach, which exposed 250,000 records some dating back to 1978, showed how legacy data retention practices can turn decades-old records into fresh liability the moment a system is compromised. The FBI’s arrest of a second ShinyHunters suspect this year highlighted how organized, financially motivated groups have industrialized the theft and resale of exactly this kind of consumer data.

What distinguishes the Burger King Japan incident is less its mechanism, which remains undisclosed, and more its sheer scale relative to the country’s population. Eleven million records is a substantial share of Japan’s roughly 124 million residents, putting this disclosure among the larger single-company breaches reported in the country in 2026.

Competitive Comparison: Burger King Japan vs Other 2026 Breaches

Placed alongside other notable 2026 data incidents, the Burger King Japan breach stands out for its record count even though it avoided the worst-case scenario of exposed payment credentials. The table below lines up several of this year’s largest consumer-facing incidents by scale and data type.

Incident	Scale	Data Exposed	Financial Data Involved
Burger King Japan app breach	11.18 million records	Name, DOB, phone, email, prefecture, gender	No, company does not store card numbers
Denmark national password breach	8.8 million records	Citizen records tied to weak credential practices	Not confirmed
UK Legal Aid Agency breach	250,000 records	Legal aid applicant data dating to 1978	Not confirmed
TFG London cyberattack	3 retail brands disrupted	Operational and retail systems across Hobbs and Whistles	Unconfirmed
Ledger hardware wallet hack	$86 million drained	Cryptocurrency wallet access	Yes, direct financial theft

The comparison makes clear that record count alone does not determine severity. The Ledger incident involved far fewer affected accounts but caused direct, immediate financial loss, while the Burger King Japan breach involves a much larger population exposed to secondary risks like phishing rather than immediate monetary theft. Both categories of harm matter, they simply unfold on different timelines.

Market Impact and Brand Trust for Burger King Japan

Restaurant Brands International, Burger King’s global parent, has not issued a separate statement distinct from BK Japan’s own notice, and the breach appears contained to the Japanese operator’s systems rather than the broader international franchise network. Still, breaches of this size tend to generate measurable, if short-lived, dips in app engagement as users grow wary of entering personal information into the affected platform.

For a quick-service brand, the app is not a side channel, it is increasingly the primary vehicle for loyalty points, mobile ordering, and targeted promotions. Any erosion in trust toward the app has a direct line back to transaction volume, since customers who stop opening the app also stop redeeming the coupons and rewards that drive repeat visits. Competing chains with similar loyalty infrastructure will be watching closely to see whether BK Japan’s response, including its regulatory filing and remediation timeline, is enough to limit reputational fallout.

Retailers have faced similar brand trust tests this year. The French supermarket cyberattack investigation, which disrupted refrigeration systems across hundreds of stores, showed how a single security failure can ripple into operational and reputational damage well beyond the initial data exposure itself.

Risk to Customers: Phishing, Smishing and Fraud

The practical risk facing the 11.18 million affected Burger King Japan app records centers on social engineering rather than direct financial theft. With names, phone numbers, email addresses, birth dates, and prefecture data in hand, attackers have the raw ingredients for highly personalized phishing emails and smishing text messages that reference real account details to appear legitimate.

Signs of a Targeted Phishing Attempt

Messages claiming to be from Burger King Japan that ask users to “reconfirm” account details or payment information
Texts referencing a specific member ID, order history, or birth date to appear credible
Links to login pages that mimic the official app but use a slightly altered domain
Urgent language pressuring immediate action, such as threats of account suspension
Requests to call an unfamiliar phone number or download an unexpected app update

No fraudulent use of the leaked data has been confirmed as of the disclosure date, but that status can change quickly once stolen datasets circulate on criminal forums. Users whose data was exposed should treat the following weeks and months as a heightened risk window rather than a closed chapter.

What Burger King App Users Should Do Now

Anyone with a Burger King Japan app account should take a handful of concrete steps rather than waiting for additional company guidance. None of these require specialized technical knowledge, and all of them meaningfully reduce exposure to the kind of follow-on fraud this breach makes possible.

Change the Burger King app password, and change it again anywhere else the same password was reused
Treat any unexpected email or text referencing the app, an order, or a loyalty reward with suspicion, especially if it asks for login credentials or payment details
Enable two-factor authentication wherever the app or linked accounts support it
Monitor bank and card statements for unfamiliar charges, even though BK Japan says card numbers were not stored
Avoid clicking links in unsolicited messages and instead navigate directly to the official app or site

For anyone looking to tighten their broader account security posture, consolidating logins behind a password manager remains one of the simplest defenses against credential-stuffing attacks that often follow large breaches like this one. TrendinTech’s own password manager setup guide walks through the process in detail for anyone who has not made the switch yet.

Predictions: What Comes Next in the Burger King Japan Breach Fallout

Based on how similar breaches have played out in Japan and elsewhere in 2026, a few outcomes look likely over the coming weeks and months.

Expect Japan’s Personal Information Protection Commission to open a formal review of BK Japan’s security practices, given the scale of records involved, even absent confirmed fraud.
Phishing and smishing campaigns referencing Burger King Japan or its app are likely to surface within weeks, as stolen datasets of this size typically circulate on criminal marketplaces soon after disclosure.
Other Japanese restaurant and retail chains running similar centralized loyalty apps will likely face pressure to publicly confirm or deny their own exposure to comparable vulnerabilities.
BK Japan will probably issue a follow-up notice detailing remediation steps, such as mandatory password resets, once its internal investigation concludes.
The incident will likely be cited in future Japanese data protection policy discussions as an example of the risk concentrated inside consumer loyalty platforms.

None of these are guaranteed, and BK Japan has not confirmed next steps beyond its initial notice and apology. But the pattern across comparable breaches this year, including the regulatory and reputational aftermath following the Ivanti zero-day disclosures, suggests a fairly predictable sequence of events once a breach of this size becomes public.

Frequently Asked Questions

How many records were exposed in the Burger King Japan data breach?
BK Japan confirmed approximately 11.18 million official-app member records were affected by unauthorized access between October 2 and October 7, 2026.

Were credit card numbers leaked in the breach?
No. BK Japan says it does not store credit card numbers on the systems involved, so no card numbers were exposed.

Were login passwords exposed?
No leakage of login passwords has been confirmed as of the disclosure.

What personal information was confirmed as part of the leak?
Member ID, email address, registration type, prefecture, gender, date of birth, full name in kanji and kana, phone number, mobile order history status, and email verification status.

When did Burger King Japan disclose the breach?
BK Japan publicly disclosed the incident on October 15, 2026, after confirming the breach internally on October 13, 2026.

Has Burger King Japan confirmed any fraudulent use of the data?
No fraudulent use or other secondary damage had been confirmed as of the company’s disclosure.

Which regulator is reviewing the breach?
BK Japan reported the incident to Japan’s Personal Information Protection Commission, the country’s primary data protection authority.

What should affected app users do right now?
Change the app password, watch for phishing messages referencing order or account details, enable two-factor authentication where available, and monitor financial statements for unusual activity.

Burger King Japan Data Breach Hits 11.18M Records [2026]