Burger King Japan Says Breach Exposed 11.18 Million Customer Records
Summary
Burger King Japan says attackers accessed a server between October 2 and 7, exposing 11.18 million app-user records. The company says payment-card numbers and credentials were not stored there and reports no confirmed secondary harm.
Key points
- Burger King Japan says unauthorized access to a server occurred between October 2 and 7, 2026.
- The breach exposed 11.18 million records belonging to users of the company's official app.
- Exposed information included names, birth dates, gender, email addresses, phone numbers, and order histories.
- The company says the server did not store credit-card numbers and investigators found no evidence that attackers accessed user credentials.
- Burger King Japan blocked access from the identified source, reported the incident to Japan's Personal Information Protection Commission, and is investigating the access method with outside cybersecurity experts.
- The company says no secondary harm, such as fraudulent use, has been confirmed, and advised affected customers to watch for impersonation attempts.
Article Details
- Victim Organization
- Burger King Japan
- Incident Type
- Unauthorized access to a server containing customer records, followed by data theft and online leakage
- Incident Date
- 2026-10-02
- Disclosure Date
- 2026-10-16
- Data Types Exposed
- Names
- Dates of birth
- Gender
- Email addresses
- Phone numbers
- Order history
- Affected Records
- 11.18 million customer records
- Operational Impact
- Burger King Japan blocked access from the identified source. The company said it found no evidence that customer credentials were accessed and had not confirmed secondary damage such as fraudulent use.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed