BK Japan, which runs Burger King restaurants in Japan, said on October 15, 2026 that a third party breached its app membership system. Data from about 11.18 million member records leaked, including names, birth dates and phone numbers.
What Happened?
- BK Japan says an outsider reached its app membership backend and took data from about 11.18 million member records.
- The exposed fields include names in kanji and kana, email addresses, phone numbers, birth dates, gender and prefecture of residence.
- Credit card numbers were never stored on the affected system. The company has not confirmed any password leak or misuse.
- Affected members got individual emails warning them to ignore calls, texts and messages that claim to come from Burger King.
BK Japan Holdings Co., Ltd., owned by Goldman Sachs Alternatives, operates the chain. Its press release says the attacker had access between October 2 and October 7, and staff spotted it on October 13. The company cut off the attack source and set up a response team. It also reported the case to the Personal Information Protection Commission, Japan’s privacy regulator.
‼️BREAKING: Burger King Japan says hackers stole over 11 million member records from its app. They were inside its member system from 2 to 7 October, taking names, birth dates, phone numbers and email addresses. The company has no idea how they got in. https://t.co/6pifaqrCD2
— International Cyber Digest (@IntCyberDigest) October 15, 2026
Order history flags sat beside birthdays in the leak
According to the company’s notice, each leaked record can carry:
- Member ID and registration type
- Full name in kanji and kana
- Email address and phone number
- Date of birth, gender and prefecture of residence
- For some members, email verification status and a flag showing whether they ever used mobile ordering
That last field shows whether a member had an order history. It doesn’t reveal what anyone ate. BK Japan says the system never held card numbers, and it hasn’t confirmed any login password leak. No fraudulent use had surfaced as of the announcement. The company pledged to “strengthen system security measures and monitoring systems” with help from outside specialists.
Two gaps stand out. How did the attacker reach the membership backend? And why did detection come almost a week after the last intrusion?
Scammers now hold the details that make a lure believable
Ensar Seker, CISO at cybersecurity company SOCRadar, told Hackread.com the bigger danger comes after the theft. A criminal with a member’s name, birthday, email and phone number could pose as Burger King support, he said. That person could cite the breach and steer the customer to a fake verification page. Seker called it a plausible follow-on threat, and he added there’s no evidence such a campaign has started.
The ordering flag matters too. “Knowing whether someone used mobile ordering could help tailor a convincing message,” Seker said. He argued that companies should guard profile data as closely as passwords and payment details. That means collecting less, limiting access to member databases and flagging unusual bulk retrieval. A birthday or phone number alone, he added, should never prove identity during account recovery.
Why It Matters?
The disclosure lands in a bruising month for Japanese membership databases. Monogatari Corporation said earlier in October that 10,788,963 records leaked from its Yakiniku King app’s member system. That covered nearly all 10,808,784 registered users. Within days, JR East, Bookoff Group Holdings, Daiichikosho and Skyticket operator Adventure flagged possible exposures of about 6.09 million to 14.64 million records each.
BK Japan’s case fits the same pattern: contact details and birthdays walk out while payment data, held elsewhere, stays put. That blunts card fraud and leaves the phishing email risk intact. The brand has been here before, too. Hackers claimed earlier this year to have leaked data tied to a French Burger King franchise.
What’s Next?
For affected members, the next step is simple. Treat any call, text or email about the breach as suspect, and open the official Burger King app or website directly to check notices. That helps reduce the risk of landing on a fake page. Don’t click links, open attachments or share a password or verification code with anyone who reaches out, the core defense against common phishing tactics. BK Japan’s investigation with outside security experts still has to explain how the attacker got in, and the company hasn’t said when it will.
