Burger King Japan Breach Leaks 11M App User Records
Burger King Japan has confirmed a major security incident compromising 11.18 million customer records tied to its official mobile app. The stolen data includes names, dates of birth, phone numbers, and past purchase histories, though payment card information remained untouched.
Five days of unauthorized access inside the mobile system
Intruders maintained access to member databases for nearly a week before discovery.
According to a formal breach disclosure, Burger King Japan discovered unauthorized third-party activity inside the backend server environment managing its smartphone application. The unauthorized access began on Friday, October 2, 2026, and persisted unnoticed until Wednesday, October 7, 2026.
Internal security teams verified the extent of the compromise on Tuesday, October 13, subsequently blocking the source address. In total, attackers made off with 11.18 million customer records, representing a sizable portion of the fast-food chain's digital user base across Japan.
While financial information was stored elsewhere and avoided exposure, the scope of stolen personal profile data creates classic risks. Armed with actual names, phone numbers, and verified purchase habits, cybercriminals frequently orchestrate tailored social engineering schemes, much like the tactics observed when fake calendar invites hit corporate inboxes to harvest credentials.
The repeating pattern of fast-food app intrusions
This is not the fast-food franchise's first run-in with database exposures. In late 2024, Burger King's Russian operations suffered a compromise through third-party marketing automation vendor Mindbox, exposing customer profiles that later surfaced publicly online.
Restaurant chains have spent the past several years aggressively pushing customers away from physical counters and into loyalty apps to track behavior and lift margins. The downside is obvious: these platforms accumulate vast databases of personally identifiable data without always carrying enterprise-grade identity controls.
Burger King Japan reported the incident to the country's Personal Information Protection Commission (PPC) and noted that secondary fraud has not yet been detected. The company apologized publicly for the incident, though it stopped short of clarifying the specific vulnerability or credential failure that let attackers slip through.
Fast-food apps want to track every meal you buy, but incidents like this show why that loyalty bargain often feels lopsided. A database holding 11 million real names and purchase logs is prime fuel for targeted phishing. If you used the Japanese app, treat any incoming delivery-related texts or password resets with extreme skepticism.
What it means for international customers
The breach strictly affects the infrastructure operating Burger King Japan's regional smartphone app. If you use Burger King applications in the United States, the UK, or continental Europe, your member account operates on regional servers managed independently from the Japanese subsidiary.
However, international travelers who downloaded the local Japanese app while visiting Tokyo or other cities between launch and October 2026 likely had their contact details and regional ordering logs swept up in the leak.
With 11 million user profiles out in the wild, the immediate headache shifts to consumers who must now filter out phone and email scams built on their actual meal histories.
Frequently asked questions
Were credit card numbers stolen in the Burger King Japan breach?
No. Burger King Japan confirmed that payment card information and financial credentials were not stored on the breached member database and remained untouched during the attack.
What data was compromised?
The compromised files contained 11.18 million records containing user names, dates of birth, biological sex, email addresses, phone numbers, and past ordering logs from the official smartphone app.
Sources
- Whopper of a data breach sees Burger King Japan expose over 11 million customer records | TechRadar. techradar.com, 2026. https://www.techradar.com/pro/security/whopper-of-a-data-breach-sees-burger-king-japan-expose-over-11-million-customer-records