Last updated: October 18, 2026
The quick answer
Burger King Japan has confirmed that attackers accessed the server that manages members of its official smartphone app, exposing about 11.18 million records with names, email addresses, phone numbers, dates of birth and order history. The company says card numbers were not stored there and it has found no sign that passwords were taken. The main risk now is convincing scam emails, texts and calls, so be suspicious of any message that claims to come from Burger King.
What happened
According to the company’s disclosure, an unauthorized party reached the app’s member server between October 2 and October 7, 2026. Burger King Japan blocked the access once it was detected, finished a follow-up investigation on October 13 and published a notice on October 15. It has reported the incident to Japan’s Personal Information Protection Commission and is working with outside security experts to find out how the attackers got in.
BleepingComputer, Cybernews and Security Affairs reported the same figures. BleepingComputer also reported that the stolen data had been leaked online. Burger King Japan says it has not confirmed any fraudulent use so far and has emailed affected members individually.
| Exposed | Not exposed, according to the company |
|---|---|
| Member ID and registration type | Credit card numbers (not stored on the affected server) |
| Name (kanji and kana) | Login passwords (no evidence they were accessed) |
| Email address and phone number | |
| Date of birth, gender and prefecture | |
| Order history |
What changes for you
Your money and login are not directly at risk based on what the company has said. The danger is that criminals now hold a detailed profile: your real name, contact details, birthday and what you usually order. That makes phishing messages far more believable. Expect texts about “refunds for the data breach,” fake coupons, account verification requests or calls from someone who knows your recent orders.
This breach is one of many hitting Japanese companies this year. A researcher at Macnica has counted 119 incidents involving stolen or exposed personal data in 2026 so far. Our earlier guide to Japan’s cyberattack wave covers more steps for anyone affected by several of these.
What to do now
- Look for the official email. If you were affected, Burger King Japan says it has contacted you directly. Read it, but don’t click links in any message you weren’t expecting; go to the company’s website or app yourself.
- Ignore “compensation” or coupon offers that arrive by text or email and ask you to log in or enter details. These are classic follow-up scams after a breach.
- Change your password anyway if you reused your Burger King app password on other sites. It costs little and removes any doubt.
- Turn on two-step verification for your email account, since your address is now in criminals’ hands.
- Be careful on the phone. A caller who knows your name, birthday or last order is not proof they are from Burger King. Hang up and contact the company through official channels.
- Consider deleting your app account if you no longer use it, so less data stays on file.
Who is affected, and who isn’t
Affected: members of Burger King Japan’s official smartphone app. With about 11.18 million records involved, most people who have registered for the app in Japan should assume their data could be included.
Not affected: Burger King customers in other countries, based on the company’s notice, and people who order in Japan without registering for the app. If you’ve been caught up in other retail breaches this year, the same habits apply; see what we recommended after the ASOS data breach.
FAQ
Was my credit card stolen?
Burger King Japan says card numbers were not stored on the affected server. Still, check your statements and report any charge you don’t recognize to your card issuer.
Do I need to change my password?
The company has found no evidence that passwords were accessed. Changing it is a sensible precaution, especially if you used the same password elsewhere.
How do I know if an email from Burger King is real?
Don’t rely on the sender name or how official it looks. Avoid links and attachments, and check any notice by opening the official app or typing the company’s web address yourself.
Leave a Reply