-
Burger King Japan confirmed that about 11.18 million app member records leaked between October 2 and 7, 2026.
-
The leaked details include names, birth dates, phone numbers, email addresses, and other membership information.
-
The company says credit card numbers were not stored in the affected system. It has not confirmed any fraud.
Burger King Japan has confirmed a data leak that hit members of its mobile app. The company says an outside party entered its membership system and took customer data. The leak covers about 11.18 million member records. The company shared the news in an official notice on October 15, 2026.
Outsider Got Into Member System Between October 2 and 7
According to the company’s notice, the break-in happened between October 2 and 7. The company found the leak on October 13. It says it blocked access from the source right after it spotted the intrusion. Then it began checking what the outsider had reached.
The timeline is short. The outsider got in on October 2. The access ended on October 7. The company found the leak six days later. It was told to the public two days after that.
The leaked records hold many personal details. They include member IDs and names written in Japanese kanji and kana. Those are the two main ways of writing Japanese. Email addresses and phone numbers were also part of the data. The records list each member’s date of birth and gender too. They also show the prefecture where the member lives. A prefecture is a regional area in Japan. Registration details were exposed as well.
Some records may show two more facts. They may show whether a member confirmed an email address. They may also show whether the member used the app to order food ahead.
The number 11.18 million counts records, not people. One record can hold a name, a phone number, and a birth date together. The company has not said whether each record belongs to a different person. So the exact number of affected customers is still unclear.
The company shared some good news in its notice. It says it did not keep credit card numbers in the affected system. That means those numbers were not exposed in this case. The company also says it has not confirmed any leak of login passwords.
Cause Still Unknown as Company Works With Outside Experts
Burger King Japan has not explained how the attacker got in. That question is still open. In its notice, the company said outside experts are helping with the investigation. They are working to learn what happened and to find the cause. The company has not blamed any named hacking group. It has not pointed to a specific weakness in its system either.
The notice lists the steps the company has taken so far. It cut off the unwanted connection. It set up a team to handle the incident. It also put temporary safety measures in place. The company reported the case to Japan’s Personal Information Protection Commission. That group is the country’s data protection regulator.
More work was still underway when the company posted its notice. Burger King Japan said it was still adding security improvements. The investigation was also still running at that time.
The company also checked for signs of further harm. As of October 15, it had found no evidence of secondary damage. This includes fraud that uses the leaked information. These statements show only what the company knew on that day. They do not prove that misuse can never happen. They also do not prove that every risk is gone.
Customers Told to Watch for Scam Emails, Texts, and Calls
So far, the company has not linked any fraud to the leak. Still, the leaked details could help scammers write believable messages. A report published on October 16 warned about this danger. Criminals could use the data to make fake messages look real.
A scammer might use a name, birthday, phone number, or email address. Then the scammer could pose as Burger King support and ask for more details. This is a possible risk. Reports do not show that such scams have started.
Burger King Japan urged customers to stay alert. It asked them to watch for suspicious emails, text messages, and phone calls. Those messages may claim to come from the company. Customers should not open strange attachments. They should not follow doubtful links either. The company also warned them not to type membership details or passwords after an unexpected message. It said it is contacting affected customers by email.
Customers can check security alerts on the official website or in the app. That is safer than tapping links in messages nobody asked for. They should also keep passwords and verification codes private. Nobody should share them with a person who contacts them out of the blue.
The case adds to worries about how consumer apps protect personal data. Local news reports covered the company’s announcement on October 15. Payment card numbers were not part of this leak. Yet names, contact details, and birth dates can still create privacy and safety risks for members.
Burger King Japan is not the only fast-food brand to face data-theft concerns. In a separate case, a hacker claimed to have stolen data from Burger King France and Wendy’s UK. The claim concerns separate incidents and does not establish any connection to the Japan leak.
Burger King Japan says it plans to strengthen its security measures and monitoring systems. The company wants to stop a repeat of the incident. The investigation into how the outsider got in is still ongoing.
