BURGER King Japan disclosed a data breach affecting about 11.18 million official app users after attackers accessed the membership system between 2 and 7 October 2026. The company published the incident notice on 15 October, stating that unauthorized access occurred via a third party and that it has blocked the source and engaged external security specialists to determine the cause. The investigation is ongoing, and BK Japan did not identify the attackers or specify the initial access vector.
The compromised data comprises membership IDs, email addresses, names in Japanese characters and kana, phone numbers, dates of birth, gender, prefecture of residence, and membership registration type. It also notes whether a customer has a mobile ordering history and whether their email address has been verified.
BK Japan confirmed that credit card numbers were not stored by the system and there is no evidence that passwords were exposed; however, the disclosure does not completely rule out the risk of future misuse. The firm has established temporary countermeasures, formed an incident response team, and notified Japan’s Personal Information Protection Commission, with further security enhancements and customer notifications continuing as the investigation proceeds.
The company cautioned that, while no fraud has been confirmed so far, the leaked details could enable targeted phishing or social engineering, and urged customers to remain vigilant against suspicious communications.