Burger King Japan says an attack exposed 11.18 million customer records

Burger King Japan says an unauthorized third party reached the system that manages member information for its official app and that about 11.18 million member records leaked as a result. The company behind the notice is BK Japan Inc., the Japanese operator, and the figure is its own. Access ran from October 2 to October 7, 2026, and the company confirmed the leak on October 13.

The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.

Get TLDR →

We may earn a commission if you sign up.

BK Japan Inc., the operator named in the notice

The scope of the incident is narrower than the brand name suggests. Burger King is a chain with nearly 20,000 locations worldwide and about 350 in Japan, but the notice is about a single system: the one holding records for members of the Japanese app. The company issuing it is BK Japan Inc., written in Japanese as ビーケー・ジャパン, which operates that app. Nothing in the notice describes customer data from restaurants or apps in other countries, so a reader in another market has no basis in these documents for assuming personal information there was affected.

The number deserves careful attribution. BK Japan’s own notice dated October 15, 2026 puts the affected records at about 11.18 million, written in Japanese as roughly 1,118万件. Security outlet BleepingComputer reported the incident the next day in a story published on October 16, and carried the same count while linking the company’s PDF. Both rest on a statement from the operator rather than on an independent measurement of the stolen data. The sequence is worth laying out: unauthorized access ended on October 7, the company confirmed the leak six days later on October 13, and the public notice followed on October 15, which is how a breach that began in the first week of October reached customers only in its third.

The member data in the 11.18 million records

The notice lists the categories in the compromised records: member ID, email address, registration type, prefecture, gender, date of birth, name in kanji and katakana, and phone number. Two further fields are flags rather than content, namely whether the member has mobile order history and whether the email address has been verified. BleepingComputer’s summary describes order history as part of the exposed data, while the company’s wording points to a yes-or-no indicator of its existence.

Those fields are enough to make a convincing phishing message. A scammer holding a name, a verified email address and a phone number can write to a victim as Burger King and reference the app, the member’s prefecture or the fact that the person has ordered ahead before. That is the risk the company itself flags when it asks customers to be wary of suspicious emails, text messages or calls impersonating the company or its services. The instruction is specific: do not open links or attachments in such messages, and do not enter member information or passwords in response to them. Because the contact details of 11.18 million members now sit outside the company’s control, that advice applies to every member of the app, not only to those who notice something odd.

What BK Japan says it has and has not confirmed

The company says it has confirmed unauthorized access and the external leak of member information during the October 2 to 7 window. It does not hold credit card numbers, so none were leaked, according to the notice. On passwords, the wording is cautious: no leak of login password information has been confirmed so far. BleepingComputer quotes the company as saying that at this time, “no secondary damage, such as fraudulent use, resulting from this incident has been confirmed.”

Open questions remain. How the attackers got in is still under investigation with outside cybersecurity specialists, and the notice does not yet explain the entry route. BK Japan says it has blocked the access source, applied temporary countermeasures, set up a response headquarters and reported the incident to Japan’s Personal Information Protection Commission. Permanent fixes and email notices to affected customers are still to come. BleepingComputer reports that the company apologized to customers whose data was stolen and leaked online, a description that goes beyond the notice’s more procedural wording about a leak to outside parties. Customer service is open weekdays from 10:00 to 17:00 at 0120-945-630, closed on weekends and holidays, and the notice also lists an email contact at [email protected] for members with questions about their own records.

Reading the notice against a run of Japanese incidents

The disclosure lands in a month crowded with Japanese cyber incidents. BleepingComputer’s coverage links to reports on a ransomware attack that disrupted systems at Keio, a cyberattack that forced Japan’s largest taxi operator to shut its systems, and breaches of employees’ Microsoft and Google email accounts at Nikkei, and a Japanese security researcher at Macnica keeps a running log of web incidents for October 2026. Each involves a separate organization with its own cause and timeline, and none of those reports establishes a link to the Burger King member-system intrusion.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

The day in tech, in one email: Get TLDR →

We may earn a commission if you sign up.