Cybersecurity
Burger King Japan discloses breach of 11.18 million records
Burger King Japan said attackers accessed a server holding customer data for its official app between 2 and 7 October, and the company reported the incident to Japan's privacy regulator.
- Burger King Japan said attackers accessed a server that held 11.18 million customer records linked to its app.
- The company said the access took place between 2 October and 7 October 2026 and was confirmed after a follow-up investigation on 13 October.
- Burger King Japan said the exposed data included names, dates of birth, gender, email addresses, phone numbers and order history.
- The company said it had reported the breach to Japan's Personal Information Protection Commission and was investigating the entry point with outside cybersecurity experts.
- Burger King Japan said it had not confirmed secondary damage and warned customers about messages or calls that might impersonate the company.
Burger King Japan said it had completed a follow-up investigation on 13 October and concluded that unauthorised access had occurred on a system used for member information in its official app. It said the access ran from 2 October to 7 October 2026.
The company said the affected records covered users’ names, birth dates, sex, email addresses, phone numbers and order history. It said the server did not store credit card numbers and that it had found no evidence that account credentials were taken.
Burger King Japan said it had reported the breach to Japan's Personal Information Protection Commission and was investigating how the server was reached with help from external cybersecurity specialists. It said it blocked access from the source once it became aware of the issue.
The company warned customers about emails, text messages and phone calls that might pose as Burger King Japan and told them not to open links or attachments or enter member details or passwords. It said no secondary damage, including fraudulent use, had been confirmed.
Named in this story
People
- Yutaka Sejiyama
- the Macnica researcher cited on this year’s incidents
Companies
- Burger King Japan
- disclosed the breach and reported it to regulators
- Burger King
- the multinational chain Burger King Japan belongs to
- Macnica
- employer of the researcher cited on incident trends
Governments and agencies
- Japan's Personal Information Protection Commission
- received the breach report
How the source tells it
The piece is mostly straight reporting, but it briefly leans into alarmist framing and ends with a promotional report plug.
- alarm loaded labels for the breach and a wider attack-wave frame
- vendor boosterism a late report plug that shifts from the incident to self-promotion