Burger King Japan (BK Japan): ~11.18 million official-app member records exposed after unauthorised access 2–7 Oct; detected 13 Oct, notice 15 Oct — names, emails, phones, DOB; no card numbers stored
BK Japan (株式会社ビーケー・ジャパン), operator of Burger King restaurants in Japan, published a customer notice on 15 October 2026 saying a third party gained unauthorised access to the system that manages official smartphone-app member data. The access window was Friday 2 October through Wednesday 7 October 2026; the company says it confirmed the leak on Tuesday 13 October and immediately blocked the source. About 11.18 million member records were involved. Fields named in the notice include member ID, email address, registration type, prefecture, gender, date of birth, name (kanji and kana), phone number, whether the member had mobile-order history, and whether the email was verified. BK Japan says it does not hold credit-card numbers, so cards were not in the leak, and that login-password leakage has not been confirmed. It has not confirmed secondary misuse so far. Actions listed: cut off the attacker, temporary mitigations, an incident response team, a report to Japan's Personal Information Protection Commission, ongoing investigation with external specialists, and email notices to affected customers. Primary: BK Japan customer PDF notice (15 Oct 2026); wires: Kyodo (15 Oct) and BleepingComputer.
- Product
- Burger King Japan official smartphone app member system
- Versions
- n/a — incident (unauthorised access 2–7 Oct 2026; confirmed 13 Oct)
- Exploited in Australia?
- unknown
- Patch to
- Affected BK Japan app members: watch for phishing SMS/email that quotes correct personal details; do not open unexpected links or enter passwords. Card numbers were not held by BK Japan for this system. Operators of loyalty apps: treat member PII stores as high-value targets, monitor for bulk export, and keep payment data off the same host where possible.
Primary: BK Japan — apology and notice on unauthorised access to official-app member information (15 Oct 2026, Japanese PDF) · Vendor: Burger King Japan / BK Japan · Kyodo News — Burger King's Japan operator says 11.18 mil. customer records exposed (15 Oct 2026)