Burger King Japan has disclosed that attackers got into the server that manages member information for its official smartphone app and leaked records on 11.18 million customers. The company says it concluded its follow-up investigation on October 13 and found unauthorized access between October 2 and October 7, 2026.
The exposed data includes names, dates of birth, gender, email addresses, phone numbers and order history. Burger King Japan says the server did not hold credit card numbers and that it found no evidence the attackers accessed user credentials. It blocked the source of the access, reported the breach to Japan’s Personal Information Protection Commission and is working with outside security experts to find out how the attackers got in. It also says it has not confirmed any fraud resulting from the leak so far.
Because names, phone numbers and order history are the kind of detail scammers use to sound convincing, the company warns affected customers to be careful with emails, text messages and phone calls that claim to come from Burger King Japan: do not click links, open attachments, or enter member information or passwords. BleepingComputer notes this is one of many recent attacks on Japanese companies, citing researcher Yutaka Sejiyama of Macnica, who has logged 119 incidents involving personal information theft or exposure this year.