Burger King Japan says hackers exposed about 11.18 million app member records, including names, email addresses, phone numbers and dates of birth. The company says no credit card numbers were stored on the affected server and it found no evidence passwords were accessed.
The intrusion ran from October 2 to October 7, 2026. Burger King Japan announced it on October 15 and is warning customers to watch for phishing.
What data was exposed?
According to the company's notice, as reported by BleepingComputer and Cybernews:
| Exposed | Not exposed (per company) |
|---|---|
| Member ID | Credit card numbers |
| Name (kanji and kana) | Passwords (no evidence of access) |
| Email address | |
| Phone number | |
| Date of birth, gender | |
| Prefecture of residence | |
| Registration type, order history |
The data has reportedly been leaked online.
How did it happen?
Burger King Japan describes "potential unauthorized third-party access" to the system that manages app member information. It has not explained how the attackers got in and is investigating with outside cybersecurity experts. It blocked the access once detected and reported the incident to Japan's Personal Information Protection Commission.
Who is affected?
Members of Burger King Japan's official smartphone app. The chain has about 350 restaurants in Japan. Customers of Burger King apps in the US and other countries are not affected by this incident.
What should customers do?
- Ignore unexpected messages claiming to be from Burger King Japan, whether email, SMS or phone calls.
- Don't click links or open attachments in those messages.
- Never enter your member details or password in response to a message.
- If you reused your app password on other sites, change it there.
- Be alert to scams that use your name and birth date to sound legitimate.
Affected members are being notified individually by email. The company says it has seen no fraudulent use of the data so far.
Is this Burger King's first breach?
No. Cybernews notes hackers claimed to have leaked data from a French Burger King franchise in February 2026, and that it found exposed Burger King data in 2023 caused by a missing password.
