Burger King Japan Breach Exposes 11 Million Customer Records

Burger King Japan, the Japanese subsidiary of the global fast-food chain, has disclosed a major data breach after attackers reached a server storing 11.18 million customer records.

Founded in Florida in 1953, Burger King now operates nearly 20,000 locations worldwide, around 350 of them in Japan.

What happened

In a press release issued Thursday, Burger King Japan said it had wrapped up a follow-up investigation on October 13 and apologized to customers whose data was stolen in early October and leaked online.

The breached servers held personal information from users of the company's official smartphone app: names, dates of birth, gender, email addresses, phone numbers, and order history.

According to the company, the unauthorized access took place between October 2 and October 7, 2026. Once the intrusion was spotted, Burger King Japan immediately cut off access from the offending source.

What was spared

The company stresses that the compromised server did not store credit card numbers and that it found no evidence the attackers reached user credentials. As of the announcement, no secondary harm such as fraudulent use had been confirmed.

The breach has been reported to Japan's Personal Information Protection Commission (PPC), and the company is working with outside cybersecurity experts to determine how the server was accessed.

Affected customers were urged to watch for suspicious emails, texts, and calls impersonating Burger King Japan, and to avoid clicking links, opening attachments, or entering their data or passwords.

A wave of attacks on Japanese business

The incident joins a string of cyberattacks on major Japanese firms since the start of the year, including entertainment-system maker Daiichi Kosho, cloud operator IDC Frontier, publishing giant Nikkei, railway operator Keio, car-sharing service Times Car, provider Sakura Internet, taxi operator Nihon Kotsu, and telecom giant KDDI.

Macnica researcher Yutaka Sejiyama has counted 119 incidents involving the theft or exposure of personal data this year. He observes that attackers are now probing websites and APIs for access-control, configuration, and authentication weaknesses, and exploiting known (n-day) vulnerabilities.

Source: Bleeping Computer