Millions of Burger King customers in Japan may face an increased risk of phishing scams after hackers accessed personal information stored in the restaurant chain’s official mobile app system. The incident affected approximately 11.18 million membership records, making it a significant data breach for the company’s Japanese operations.
BK Japan, which operates Burger King restaurants in the country, disclosed the incident on October 15, 2026. Its investigation established that unauthorized access occurred between October 2 and October 7, with the company confirming the data leak on October 13.
The compromised information includes customers’ names, email addresses, phone numbers, dates of birth, gender, prefecture of residence, and membership IDs. Additional exposed fields indicate registration categories, whether email addresses were verified, and whether accounts had been used for mobile ordering.
However, the company emphasized that it does not store customers’ credit card numbers in the affected system. Investigators have also found no evidence that account login passwords were exposed.
Although payment credentials were not compromised, the stolen personal details could still be useful to cybercriminals. Someone possessing a customer’s name, email address, and phone number could create convincing messages impersonating Burger King, potentially tricking recipients into visiting fraudulent websites or disclosing additional information.
BK Japan has not revealed how the attackers entered its systems or identified those responsible. The company is working with external cybersecurity specialists to establish the cause and determine whether further protective measures are necessary.
After discovering the intrusion, BK Japan blocked communications from the unauthorized access source and established an internal response team. It also reported the incident to Japan’s Personal Information Protection Commission and began notifying affected customers by email.