Burger King Japan has disclosed a data breach that exposed over 11 million customer records linked to the company’s official smartphone app.
“We identified a potential unauthorized third-party access to the system that manages member information for our official app and conducted an investigation,” the food giant stated.
The Japanese subsidiary of the American food giant Burger King conducted a subsequent investigation that concluded on October 13, 2026, and determined that unauthorized access had occurred.
Burger King Japan data breach leaked extensive personal information
Burger King Japan’s investigation found that attackers accessed personal information after breaching the company’s member information storage server between Friday, October 2, 2026, and Wednesday, October 7, 2026.
The breach exposed the company’s official smartphone app user data, including member IDs, names, dates of birth, genders, phone numbers, email verification status, and order history, including whether the impacted member had a mobile order.
However, the data breach did not leak complete purchase details or items ordered. Nevertheless, attackers could still use that information to craft compelling phishing lures that could expose more sensitive information, such as credit card numbers and account login credentials.
“The risk extends beyond the initial breach,” warned Ensar Seker, CISO at cybersecurity company SOCRadar. “Names, dates of birth, email addresses and phone numbers can help criminals make fraudulent messages feel credible.
“An attacker could impersonate Burger King support, reference the breach and ask a customer to ‘secure’ their account through a fake verification page. That is a plausible follow-on threat, rather than evidence that such a campaign has already occurred.”
Nevertheless, the data breach did not leak customers’ payment information, because the compromised server did not store credit card information. The cyber attack also did not leak user account login information, including passwords.
According to Seker, “Even seemingly minor account details can strengthen the deception. Knowing whether someone used mobile ordering could help tailor a convincing message without knowing what they actually purchased. Customers should open the official app or website directly when checking security notices, and should never share passwords or verification codes with someone who contacts them.”
At present, Burger King Japan has found no evidence that the attackers have misused the stolen information to commit fraud. Nevertheless, the Japanese fast food chain advised affected individuals to watch out for suspicious phone calls and text and email messages.
Victims should also avoid clicking suspicious links or downloading unfamiliar email attachments to prevent phishing or malware installation. Victims should also avoid sharing personal details, such as passwords or credit card details, as no reputable company requests sensitive information via call, SMS, email, or online chat.
Meanwhile, Japan’s Personal Information Protection Commission (PPC) has been notified of the data breach and has launched an investigation. External cybersecurity experts are also involved in the probe to determine the scope of the incident and assist the food retailer in responding to the breach.
So far, the number of affected individuals remains undisclosed, and Burger King Japan has not disclosed how the attackers gained access, including whether they employed phishing or exploited compromised login credentials or a security vulnerability.
“SecurityScorecard also observed poor external security hygiene across Burger King’s broader attributed footprint,” said Dr. Aleksandr Yampolskiy, Co-Founder and CEO at SecurityScorecard. “Its SecurityScorecard showed a D rating-61 out of 100-with a 31-point downward indicator showing deterioration in the displayed score. The comparison period is not shown. For context, SecurityScorecard’s published validation found F-rated companies were 13.8 times more likely to experience a breach than A-rated companies.”
“Our report observed 2,460 findings, including 63 critical-CVSS vulnerability observations representing 32 distinct CVEs across six IP addresses. We observed internet-visible database services, and the report flagged one service as ‘IP Camera Accessible,’ although its AirTunes fingerprint leaves the device type unconfirmed,” added Yampolskiy. “One Burger King IP address geolocated to Kazakhstan accounts for 249 of the 475 CVE findings in the last-observation categories. One example is CVE-2024-38475, an Apache vulnerability on CISA’s Known Exploited Vulnerabilities list, first flagged in April 2025 and last observed in October 2026. These findings require validation, and we have not connected them to the Japan breach.”
The food retailer is also working with external cybersecurity experts to strengthen its IT systems to prevent a similar data breach in the future. Burger King Japan has also contacted impacted individuals and launched a thorough investigation.
“You have to have proper Zero Trust segregation and access controls,” added Yampolskiy. “The scale of this exposure raises questions about whether access was sufficiently restricted and customer information adequately segregated. The investigation needs to establish which controls failed. One compromised account or application should not provide unrestricted access to customer data.”
Cyber attacks continue to target Japanese companies
The Burger King Japan data breach follows a string of high-profile cyber attacks targeting major Japanese companies.
Between October 1 and October 2, 2026, Japanese entertainment system maker Daiichi Kosho suffered a data breach that exposed the personal information of more than 8.7 million people after malware infected a third-party vendor’s employee computer.
Other prominent Japanese companies, including mobility providers Times Car ride-sharing service and taxi operator Nihon Kotsu, publishing powerhouse Nikkei, private railroads operator Keio, tech giant Sakura Internet, and KDDI, a SoftBank Group’s data center and cloud infrastructure provider, have also reported similar data breaches.
Similarly, Japan’s major travel agency H.I.S. Co. has disclosed a data breach that leaked customers’ passport information.
