Burger King Japan discloses data breach impacting 11 million customer records

Data Breach Details

Burger King Japan announced a data breach affecting 11.18 million customer records. The incident involved unauthorized access to a server managing member information for the company's official smartphone app. The breach was identified on October 13, 2026, and occurred between October 2 and October 7, 2026.

Compromised Information

The exposed data includes personal details such as names, dates of birth, gender, email addresses, phone numbers, and order history. Burger King Japan stated that credit card numbers were not stored on the compromised server, and there is no evidence that user credentials were accessed by the attackers.

Company Response and Investigation

Upon discovering the unauthorized access, Burger King Japan immediately blocked the source. The company has reported the breach to Japan's Personal Information Protection Commission (PPC) and is conducting an investigation with external cybersecurity experts to determine how the attackers gained access. The company has apologized to affected customers and stated no secondary damage, such as fraudulent use, has been confirmed.

Customer Advisory

Burger King Japan advised affected customers to be vigilant for suspicious emails, SMS messages, and phone calls that may impersonate the company. Customers are urged to avoid clicking unknown URLs, opening attachments, or entering personal information or passwords in response to such communications.

Broader Context

This incident is part of a series of cyberattacks impacting Japanese companies this year. Other organizations affected include Daiichi Kosho, IDC Frontier, Nikkei, Keio, Times Car, and Sakura Internet, indicating a trend of increased cyber threats in the region.