Burger King Japan data breach exposes 11 million customer records

Burger King Japan disclosed that attackers accessed a server holding 11.18 million customer records tied to its official smartphone app. The exposed fields include names, dates of birth, gender, email addresses, phone numbers and order history. The company says the compromised server did not store credit card numbers and found no evidence that user credentials were taken. Unauthorized access occurred between October 2 and October 7, was identified in a follow-up investigation concluded on October 13, and access from the source was immediately blocked. Burger King Japan reported the incident to Japan’s Personal Information Protection Commission, engaged external cybersecurity specialists, apologized to affected customers, and urged vigilance against phishing attempts.

The incident is part of a broader wave of breaches affecting major Japanese firms this year - including Daiichi Kosho, IDC Frontier, Nikkei, Keio, Times Car, Sakura Internet, Nihon Kotsu and KDDI - as attackers increasingly probe websites and APIs for access-control, configuration and authentication weaknesses and exploit known (n-day) vulnerabilities. Macnica researcher Yutaka Sejiyama logged 119 personal-information incidents in 2026 and warns that attackers who achieve initial access often escalate using valid credentials. Burger King Japan reports no confirmed secondary damage such as fraud so far.