"We identified a potential unauthorized third-party access to the system that manages member information for our official app and conducted an investigation," Burger King Japan said.
Burger King Japan confirms 11.18 million customer records exposed
Burger King Japan disclosed that attackers accessed a server containing 11.18 million customer records, the company announced after concluding a follow-up investigation on October 13, 2026. The company said the stolen information belonged to users of its official smartphone app and acknowledged the data was stolen in early October and leaked online.
The disclosure notes Burger King was founded in 1953 in Florida and operates nearly 20,000 locations worldwide, including 350 in Japan — context the company included as it apologized to customers whose information was taken. In its press release the company said it "sincerely apologize[d] for the great inconvenience and concern" caused by the incident and stated that, "At this time, no secondary damage, such as fraudulent use, resulting from this incident has been confirmed."
Data fields exposed — and what the company says was not accessed
Burger King Japan said the breached servers stored personal information collected through the chain's app, specifically naming customers' names, dates of birth, gender, email addresses, phone numbers, and order history. The company also stated the compromised server did not store customer credit card numbers and reported it had found no evidence that the threat actors accessed user credentials.
Alongside those findings, the company warned affected customers to monitor communications for impersonation attempts: watch for suspicious emails, SMS messages, and phone calls that may impersonate Burger King Japan and avoid clicking URLs, opening attachments, or entering member information or passwords.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTimeline, containment, and the ongoing investigation
Burger King Japan said it determined on Tuesday, October 13, 2026, that unauthorized access had occurred between Friday, October 2, 2026, and Wednesday, October 7, 2026. The statement says that "upon becoming aware of the unauthorized access, we immediately blocked access from the source in question."
The company has reported the breach to Japan's Personal Information Protection Commission (PPC) and is investigating how attackers gained access to the compromised server with assistance from external cybersecurity experts. Burger King Japan said it concluded a follow-up investigation on October 13 and is continuing work to understand the initial access vector.
Context: a wave of attacks across Japanese companies and research findings
The Burger King Japan breach adds to a string of cyber incidents affecting major Japanese firms since the start of the year. The company listed other victims in the wider incident wave, naming entertainment system maker Daiichi Kosho, cloud and digital infrastructure firm IDC Frontier, Japanese publisher Nikkei, private railway operator Keio, car‑sharing service Times Car, cloud and data center service provider Sakura Internet, taxi operator Nihon Kotsu, telecommunications giant KDDI, and "many others."
Macnica researcher Yutaka Sejiyama has catalogued 119 cybersecurity incidents this year involving personal information theft or exposure, and reported that attackers are probing websites and APIs for access‑control, configuration, and authentication weaknesses and are exploiting known (n‑day) vulnerabilities. The Blue Report 2026, cited in the same reporting, warns that "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." The report measures defenses technique by technique across 338 million simulations run in customer production environments.
What this means for technologists, the Personal Information Protection Commission, and affected customers
- Technologists and security teams: Macnica's analysis highlights attackers probing websites and APIs for access‑control and authentication weaknesses and exploiting known (n‑day) flaws — specific behaviors security teams will need to watch for as they investigate and harden app back ends and related infrastructure.
- The Personal Information Protection Commission (PPC): Burger King Japan has reported the incident to the PPC; the company is conducting a joint investigation with external cybersecurity experts to determine how the compromised server was accessed and the full scope of the leak.
- Affected customers: The company has advised people whose records were exposed to be alert for impersonation via email, SMS, or phone, and to avoid clicking links, opening attachments, or entering member information or passwords tied to Burger King Japan accounts.
The breach raises a concrete operational question Burger King Japan and its investigators are already trying to answer: how attackers reached the server that held membership data during the October 2–7 window. The company says it has blocked the source and engaged outside experts; the next steps are technical — pinning down the access vector, confirming whether credentials or other internal controls were bypassed, and determining whether any further secondary harm appears. For now, the firm reports no confirmed fraudulent use and has alerted regulators and customers.
Source: Bleeping Computer — Burger King Japan data breach exposes 11 million customer records
