Burger King Japan data breach exposes 11 million customer records

Burger King Japan discovered that attackers had accessed a server managing member information for its official smartphone app. The incident affected customer records and led to information being leaked online. The company completed a follow-up investigation on October 13, 2026, and apologized to affected customers.

The server contained names, birth dates, gender, email addresses, phone numbers, and order histories. Burger King Japan said unauthorized access occurred from October 2 through October 7. After detecting the activity, it blocked access from the source involved.

The company said credit card numbers were not stored on the compromised server. It also found no evidence that attackers accessed user credentials. Burger King Japan reported the incident to Japan’s Personal Information Protection Commission and is investigating the entry point with external cybersecurity experts. Customers were warned about impersonation attempts through email, SMS, and phone calls.

A data breach is an incident in which people without permission access, copy, expose, or steal information held by an organization. It matters because personal details can leave the company’s intended security controls and reach unauthorized recipients. A breach does not require payment information to be involved; names and contact details can also create risks.

In this case, Burger King Japan identified potential unauthorized third-party access to the system managing official-app members. The company determined that access occurred between October 2 and October 7, 2026. The affected server stored customer records, and the information was subsequently leaked online. Burger King blocked access from the source after learning about it.

The exact entry method remains under investigation. External cybersecurity experts are helping examine how the attackers reached the server. Burger King reported the incident to Japan’s Personal Information Protection Commission. It said no evidence showed that credentials were accessed, but customers still face risks from messages or calls pretending to come from Burger King Japan.

Burger King Japan said the breached server contained 11.18 million customer records. That figure represents users of the company’s official smartphone app whose member information was stored on the compromised system. The scale matters because a large dataset can give attackers many opportunities to target customers individually.

The exposed information included names, dates of birth, gender, email addresses, phone numbers, and order history. These details can identify people and provide ways to contact them. Order histories may also help a scammer make a message sound more believable by referring to a customer’s relationship with the company.

The company said the server did not store customer credit card numbers. It also found no evidence that threat actors accessed user credentials. Burger King Japan nevertheless warned affected customers to watch for suspicious emails, SMS messages, and phone calls. The company has reported the incident and continues investigating the breach with outside cybersecurity experts.

Credit card numbers were not stored on the compromised server, so the breach did not directly expose those payment details from that system. Burger King Japan also found no evidence that attackers accessed user credentials. These findings reduce the chance of immediate card misuse or direct account access based on stolen passwords.

The distinction matters because payment information and login credentials can enable different types of harm. A stolen card number may support unauthorized purchases, while a stolen password can let attackers enter an account. In this incident, the company said neither category was found among the accessed server data. However, names, email addresses, phone numbers, and other details were exposed.

The company has not confirmed secondary damage, including fraudulent use, from the incident. Customers should still treat unexpected messages and calls cautiously. Burger King Japan specifically advised against clicking URLs, opening attachments, or entering member information or passwords. The company is investigating the attack path, so the final risk assessment may depend on what that investigation finds.

Leaked names, contact details, birth dates, and order histories can make impersonation scams appear authentic. Attackers could claim to be Burger King Japan and refer to a customer’s app activity or an order. The goal could be to persuade someone to reveal more information, including a password, or interact with a malicious message.

The company warned about suspicious emails, SMS messages, and phone calls that may impersonate Burger King Japan. A message might direct a recipient to click a URL, open an attachment, or enter member information. The exposed data could help scammers personalize those approaches, even though the article does not report a confirmed scam using the leaked records.

Burger King Japan said no secondary damage, such as fraudulent use, had been confirmed. Customers should therefore treat unexpected requests as untrusted and avoid the actions the company identified. The warning is especially important because attackers can combine leaked personal details with other information obtained elsewhere. The breach investigation and monitoring will help determine whether further misuse occurs.

Websites and APIs are common entry points because they connect users, apps, and backend systems. Attackers test whether those interfaces properly enforce permissions, reject invalid requests, and require strong authentication. They also look for configuration mistakes, such as systems exposing functions or data that should be restricted.

The article describes attackers probing for weaknesses in access control, configuration, and authentication. They also exploit known, or n-day, vulnerabilities in software. If a system accepts a valid credential, an attacker may appear to be a legitimate user. That can make activity harder to stop than an obvious break-in.

Macnica researcher Yutaka Sejiyama found 119 cybersecurity incidents involving personal-information theft or exposure this year. The Blue Report 2026 measured defenses across 338 million simulations in customer production environments. Its findings showed that once attackers used valid credentials, only 37% of their actions were blocked. Companies therefore need layered defenses beyond the initial login barrier.

Personal data is information connected to an identifiable person. In this incident, it included names, dates of birth, gender, email addresses, phone numbers, and order histories. Such information can reveal who someone is, how to contact them, and their relationship with a service. Protecting it matters because unauthorized exposure can create privacy and fraud risks.

An app is only the customer-facing part of a larger system. Member information may be stored on a server that the app uses, and weaknesses in that server can expose many records at once. Burger King Japan’s breach shows this connection clearly: attackers reached the system managing official-app member information, not necessarily the app interface itself.

The company remains responsible for responding because it collected and managed the member information. Burger King Japan blocked the access source, reported the breach to Japan’s Personal Information Protection Commission, apologized, and hired external experts to investigate. It also warned customers about impersonation attempts. These steps show why data protection includes prevention, detection, notification, and follow-up.