The story in brief
- BK Japan disclosed a leak of approximately 11.18 million official-app member records on 15 October 2026. This notice concerns Japan, not Burger King's worldwide customer base.
- Unauthorised access occurred from 2 to 7 October. The company says it confirmed the leak on 13 October.
- The fields include names, dates of birth, contact details and account attributes. The company does not hold card numbers and had not confirmed a login-password leak.
- BK Japan says email notices to affected customers are being sent progressively. Verify messages through the official service and do not submit passwords or codes through unexpected links.
What happened to the Japan app?
The Burger King data breach reported in October 2026 concerns the official app operated by BK Japan. Its 15 October notice confirms that an outside party accessed a system managing app-member information and that records were leaked.
The investigation places the access between 2 and 7 October, with confirmation of the leak on 13 October. BK Japan says it blocked access from the unauthorised source once it became aware of the access. The detailed cause and route into the system remained under investigation with external specialists.
Neither the operator's notice nor the Japan Today/Kyodo report establishes a worldwide incident. Being a Burger King customer in another country does not, on its own, place you in this affected Japan-app dataset.
Why 11.18 million records is not 11.18 million people
The official Japanese notice describes approximately 11.18 million items of app-member information. It does not provide a separately verified count of unique individuals. A records total is a measure of the disclosed dataset, not permission to infer how many distinct customers it represents.
The notice does not establish that every member had all the listed data fields. Use a genuine individual notice or the company's official customer-service route for questions about a specific account.
What information was leaked?
BK Japan lists member IDs, email addresses, registration type, prefecture, gender, date of birth, names in kanji and kana, phone numbers, whether a mobile-order history exists, and whether the email address was verified.
A prefecture is a regional field, not necessarily a full home address. The mobile-order field records whether there is an order history; the notice does not establish that individual orders or a detailed purchase history were leaked. Those distinctions avoid overstating what attackers obtained.
Were passwords or card numbers exposed?
BK Japan says it does not hold credit-card numbers and that those numbers were not leaked in this incident. It separately says a leak of login-password information has not currently been confirmed. Those are different findings: absence of a confirmed password leak is not an unconditional guarantee.
The operator also reported no confirmed secondary harm, including fraudulent use, at the time of its notice. That does not eliminate the possibility of future phishing. A name, birth date and phone number can make a fabricated account-security message sound credible.
What should Japan-app members do?
Follow the operator's warning without treating any new email about the incident as automatically genuine.
- Open the genuine service. Use the installed official app or navigate directly to Burger King Japan's website to check information and support contacts.
- Do not follow account-check demands. BK Japan advises against opening suspicious links or attachments and entering member details or passwords in response to unexpected contact.
- Respond if you disclosed a password. Change it through the real service and replace it anywhere you reused it. Secure your email account with multi-factor authentication where available.
- Contact your bank if necessary. The notice does not report leaked card numbers. If you separately gave a suspicious caller payment information or see an unauthorised transaction, contact your bank directly.
Checking your wider exposure
A ProtectMyData exposure scan checks available evidence linked to the email address you choose to submit. It is not definitive proof that you were, or were not, affected by an incident discussed here. A result from another breach does not establish involvement in this one.
Removing information from public websites or data brokers can reduce public exposure. It does not erase breach records, recover stolen copies or replace account-security and fraud-recovery steps. Reading this article does not run a lookup. The optional scan requires you to enter an email and submit the form.
What is BK Japan doing about notifications?
The official notice lists blocking the unauthorised source, temporary countermeasures, a response headquarters and a report to Japan's Personal Information Protection Commission as completed actions.
Permanent measures, specialist investigation and email guidance to affected customers were continuing or being carried out progressively. The notice does not say that every affected person had already received an email. It warns about suspicious emails, texts and calls impersonating Burger King.
Timeline
Access window
BK Japan identifies these dates as the period of unauthorised access.
Leak confirmed
The company's investigation establishes that app-member information was leaked.
Official notice published
The operator discloses approximately 11.18 million records, lists the fields and says customer email guidance is being sent progressively.
Kyodo report appears
Japan Today carries Kyodo's account of the Japan operator's disclosure.
Sources and reporting limits
Sources and reporting limits
We checked BK Japan's Japanese-language primary notice dated 15 October and Japan Today's 16 October Kyodo report on 19 October 2026. The operator's own field list and qualified password wording control this article.
We have not inspected the leaked dataset, verified the number of unique people, or established an attack method. The report does not connect this incident to unrelated Burger King systems or other Japanese-company breaches.
Update notes
19 October 2026: First report prepared from the sources listed below. Incident dates and source limitations are distinguished from this publication date.
Questions readers ask
Does the Burger King app data breach affect every country?
The verified notice concerns BK Japan's official app-member system. It does not establish a breach affecting the chain worldwide.
Were 11.18 million different customers affected?
The company reports approximately 11.18 million member records. A distinct-person count is not established.
Should I reset my Burger King password?
BK Japan had not confirmed a login-password leak in its 15 October notice. Change your password promptly if you entered it on a suspicious page, and replace reused passwords as a separate account-safety measure.
Sources
- Apology and notice concerning official app member information leaked through unauthorised access (Japanese)BK Japan, official notice, 15 October 2026
- Burger King's Japan operator says 11.18 mil customer records exposedJapan Today / Kyodo, 16 October 2026
- What to do if you were scammedUS Federal Trade Commission, Consumer guidance, June 2026
Published 19 October 2026. Last checked and updated 19 October 2026. We do not link to attacker material.
