Whopper of a data breach sees Burger King Japan expose over 11 million customer records

Burger King Japan discloses breach affecting 11.18 million customer records from its mobile app platform Exposed data included personal details and order histories, though payment information was not compromised Company reported no confirmed misuse and notified regulators while investigating the intrusion The Japanese subsidiary of Burger King has confirmed suffering a data breach and apologized for losing sensitive data on millions of customers.

In a breach notification letter, Burger King Japan confirmed the exact date of the breach, as well as the nature of the data that was stolen.

"We identified a potential unauthorized third-party access to the system that manages member information for our official app and conducted an investigation," the company said in the letter.

"As a result, it was determined on Tuesday, October 13, 2026, that unauthorized access occurred between Friday, October 2, 2026, and Wednesday, October 7, 2026, resulting in a leak of member information.

Upon becoming aware of the unauthorized access, we immediately blocked access from the source in question." Echoes of Russia The investigation determined that 11.18 million customer records were nabbed, which was mostly data on people using the company’s official smartphone app.

It includes people’s names, dates of birth, genders, email addresses, phone numbers, and order histories.

While credit card and other payment data was not exposed, personally identifiable information (PII) is still more than enough to launch convincing phishing emails and escalate to business email compromise (BEC), malware , or even ransomware attacks.

Burger King Japan stressed that there is no evidence of data misuse yet and added that the breach was reported to the country’s Personal Information Protection Commission (PPC).

"We sincerely apologize for the great inconvenience and concern this situation has caused to our customers and all others involved," it added.

"At this time, no secondary damage, such as fraudulent use, resulting from this incident has been confirmed." Burger King’s food isn’t the only tasty thing about the company, it seems.

Cybercriminals also love breaking in and stealing data.

Back in 2024, for example, the Russian arm of Burger King suffered a data breach at the hands of unknown threat actors and in late September this year, that data leaked online.

In October 2024, Burger King told local media about an attack on Mindbox, a domestic marketing automation platform the company had been using.

Through Mindbox, the threat actors managed to obtain sensitive company data, including information belonging to the customers.