Burger King Japan has disclosed a data breach that exposed the personal information of 11.18 million customers after attackers gained unauthorized access to a server containing records linked to the company’s official smartphone app.
In a statement released Thursday, the Japanese subsidiary of the global fast-food chain said it completed a follow-up investigation on October 13 and confirmed that customer information had been compromised between October 2 and October 7, 2026. The company apologized to affected customers after the stolen data was reportedly leaked online.
The compromised server stored personal information belonging to users of Burger King Japan’s official app, including names, dates of birth, gender, email addresses, phone numbers, and order histories. The company said it blocked access from the suspected source as soon as it became aware of the incident.
“We identified a potential unauthorized third-party access to the system that manages member information for our official app and conducted an investigation,” Burger King Japan said in its official notice.
The company said the affected server did not store customers’ credit card numbers and that its investigation had found no evidence that the attackers accessed user credentials. However, the exposure of contact details and order histories could put affected customers at risk of phishing attacks and other attempts to misuse their personal information.
Burger King Japan has reported the incident to Japan’s Personal Information Protection Commission (PPC) and is working with external cybersecurity experts to determine how the attackers gained access to the server. The investigation is also examining the circumstances surrounding the unauthorized access.
The company said it had not confirmed any secondary damage, such as fraudulent use of the stolen information, at the time of its announcement. It nevertheless urged customers to remain vigilant against suspicious emails, text messages, and phone calls impersonating Burger King Japan. Customers were advised not to click suspicious links, open unexpected attachments, or enter their membership information or passwords on untrusted websites.
Founded in Florida in 1953, Burger King operates nearly 20,000 locations worldwide, including around 350 restaurants in Japan. The breach adds the fast-food chain to a growing list of Japanese businesses that have reported cybersecurity incidents this year.
Other affected organizations include entertainment equipment maker Daiichi Kosho, cloud infrastructure provider IDC Frontier, publishing giant Nikkei, railway operator Keio, car-sharing service Times Car, and cloud provider Sakura Internet. Telecommunications company KDDI and taxi operator Nihon Kotsu have also reported cybersecurity incidents.
According to cybersecurity researcher Yutaka Sejiyama of Macnica, Japan has recorded 119 cybersecurity incidents involving the theft or exposure of personal information so far this year. His incident tracking report highlights how attackers are increasingly probing websites and APIs for weaknesses in access controls, system configurations, and authentication mechanisms, while also exploiting known vulnerabilities for which fixes may already be available.
The Burger King Japan breach underscores the risks organizations face when systems holding large volumes of customer information are exposed to unauthorized access. Even when payment information and passwords are not compromised, stolen personal details can still be used in targeted scams and phishing campaigns.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
