Burger King Japan says attackers accessed a server holding 11.18 million customer records. The company announced the breach in a press release and said its follow-up investigation concluded on 13 October. It determined that unauthorised access occurred between 2 and 7 October 2026, and the data was reportedly stolen in early October and later leaked online.
The records belong to users of the official smartphone app. They include names, dates of birth, gender, email addresses, phone numbers and order history. The company says the server did not store credit card numbers and that it found no evidence attackers reached user credentials. It says it blocked access from the source, apologised, reported the incident to Japan's data protection regulator and is investigating how the attackers got in with outside security experts. It has confirmed no secondary damage such as fraudulent use. Customers are advised to watch for suspicious emails, texts and calls impersonating the chain and not to click links, open attachments or enter member details.
The breach fits a wave of 2026 attacks on major Japanese companies. A Japanese security researcher has logged 119 incidents this year involving theft or exposure of personal information, and reports that attackers are probing websites and APIs for access-control, configuration and authentication weaknesses and exploiting known vulnerabilities. The attackers in this case have not been named.
