Burger King Japan Lost 11.18 Million Customer Records — and Found Out Fast

Burger King Japan disclosed a major data breach on October 15, confirming that attackers accessed a server holding 11.18 million customer records. The company said it concluded a follow-up investigation on October 13, which determined that unauthorized access occurred between October 2 and October 7, 2026. The stolen data was then leaked online.

The breached server stored member information for the company's official smartphone app: names, dates of birth, gender, email addresses, phone numbers, and order history. Burger King Japan says the server did not hold credit card numbers, and it found no evidence that attackers accessed user login credentials. The company has reported the incident to Japan's Personal Information Protection Commission and brought in external cybersecurity experts to determine how the attackers got in.

Burger King Japan breach: the timeline that matters

Access window: October 2 to October 7. Investigation concluded: October 13. Public disclosure: October 15. That is a fast, clean timeline by breach standards — many companies sit on incidents for months. Credit where it's due: Burger King Japan moved in under two weeks from detection to public acknowledgment.

But the details raise the uncomfortable questions. An app member database with 11.18 million records is a juicy target, and the data taken is exactly the profile package identity thieves want: full name, date of birth, email, phone number. That combination is enough to make phishing and social engineering dramatically more convincing. No passwords were taken, according to the company, which limits the direct account-takeover risk — but it does not eliminate the secondary fraud risk, which the company says has not materialized yet. "Yet" is doing a lot of work in that sentence.

Why breaches like this keep happening

This is the same story as the October breach wave: a customer-facing system holding millions of records, compromised through access the company is still investigating. The pattern across this month's incidents is consistent — attackers go where the data is concentrated, and loyalty apps, delivery apps, and member databases are the new crown jewels because they hold verified identity data tied to real people.

The contrast with the Meta GitHub breach is instructive. That incident was stolen employee credentials; this one is an exposed server. Different doors, same house. Companies keep adding digital doors — apps, loyalty programs, delivery integrations — faster than they can guard them.

What to do if you were affected

If you use the Burger King Japan app, assume your name, email, phone number, and birth date are in the wild. Practical steps:

• Watch for phishing emails and SMS messages that use your real name and order history to look legitimate. Burger King will not ask you to "verify" anything via a link.
• Be extra skeptical of any message referencing your birth date — that detail makes scams far more persuasive.
• You don't need to change a password for this one, since credentials weren't taken — but if you reused your Burger King app password anywhere else, change it there.
• Run through our guide on checking whether your data was leaked to see your broader exposure.
• If the app lets you delete your account and data, consider whether the convenience of mobile ordering is worth a permanent record of your details on a server you don't control.

The broader lesson is the one nobody wants to hear: every app you join is a future breach notification. The member databases behind fast-food apps, shopping apps, and loyalty programs hold the same identity data as banks, guarded with a fraction of the budget. Sign up accordingly — use a dedicated email alias for retail apps, and think twice about handing your real birth date to a burger app.