Burger King Japan has disclosed a significant data breach affecting its official mobile application. Attackers gained unauthorized access to a server holding 11.18 million customer records, the company announced in a statement released on Thursday.
Burger King, established in 1953 in Florida, operates as a multinational fast-food chain with approximately 20,000 locations across the globe. Japan represents one of its markets, with 350 restaurants in the country.
According to Burger King Japan's disclosure, the company completed its investigation on October 13. The breach occurred between October 2 and October 7, 2026, with stolen data subsequently posted online. The company stated: "We identified a potential unauthorized third-party access to the system that manages member information for our official app and conducted an investigation. As a result, it was determined on Tuesday, October 13, 2026, that unauthorized access occurred between Friday, October 2, 2026, and Wednesday, October 7, 2026, resulting in a leak of member information. Upon becoming aware of the unauthorized access, we immediately blocked access from the source in question."
The compromised infrastructure contained personal details from app users, including full names, birth dates, gender, email addresses, telephone numbers, and purchase history. The company emphasized that payment card information was not stored on the affected server and found no indication that attackers obtained login credentials.
Burger King Japan has notified Japan's Personal Information Protection Commission (PPC) of the incident. The organization is working with external security specialists to determine how attackers penetrated the server. The company stated: "We sincerely apologize for the great inconvenience and concern this situation has caused to our customers and all others involved. At this time, no secondary damage, such as fraudulent use, resulting from this incident has been confirmed."
The company has advised affected users to remain vigilant against fraudulent communications. Customers should be cautious of suspicious emails, text messages, and calls purporting to come from Burger King Japan, and should refrain from clicking links, downloading files, or sharing account credentials or passwords.
This breach is part of a broader pattern of cyberattacks targeting major Japanese organizations throughout 2026. Affected entities include Daiichi Kosho, an entertainment systems manufacturer; IDC Frontier, a cloud and digital infrastructure provider; Nikkei, a major publishing house; Keio, a private railway operator; Times Car, a car-sharing platform; Sakura Internet, a cloud and data center service; Nihon Kotsu, a taxi company; KDDI, a telecommunications provider; and numerous others.
Macnica researcher Yutaka Sejiyama has documented 119 cybersecurity incidents involving personal data theft or exposure in Japan this year. The researcher's analysis indicates that threat actors are systematically scanning websites and application programming interfaces for weaknesses in access controls, system configurations, and authentication mechanisms, while also leveraging previously disclosed vulnerabilities that remain unpatched.