Burger King Japan Data Breach Exposes 11.18 Million Records

BK Japan, which runs Burger King restaurants nationwide, confirmed on October 15 that attackers reached the system holding member information for its official smartphone app. Roughly 11.18 million records left the company’s control. Names, dates of birth, phone numbers and email addresses all sat in that database. The Burger King Japan data breach ranks among the country’s largest consumer incidents this year.

What the Burger King Japan Data Breach Exposed

Burger King Japan published a ten-field list of the data involved in the breach. It covers member ID, email address, registration type, prefecture, gender, date of birth, and name in both kanji and kana. The list also includes phone number, a flag showing if the account had used mobile ordering, and a flag showing email verification status. None of those fields require technical skill to abuse, and each one feeds the targeted messaging that follows a leak of this size.

Two categories stayed out of reach. The company does not store credit card numbers at all, so none could leak. Investigators also found no sign that login passwords left the system, though that finding stays provisional.

One detail deserves precision. The record shows if a member ever placed a mobile order, not what they ordered. Order contents and payment history sat outside the affected system. That distinction matters for anyone judging their own exposure from the Burger King Japan data breach.

How the Intrusion Unfolded

The attacker worked inside the member management system between October 2 and October 7. Internal teams spotted signs of possible unauthorised access and opened an investigation. On October 13 that investigation confirmed both the intrusion and the leak. The company cut off traffic from the source address as soon as it spotted the activity.

Public disclosure followed on October 15, thirteen days after the first unauthorised access. Burger King Japan reported the data breach to the country’s Personal Information Protection Commission and brought in outside specialists. The cause remains open. Investigators still cannot say how the attacker reached the system or which weakness opened the door.

That pace stands out. Japan’s Digital Agency took almost three months to go public after detecting its own intrusion this year. Tracing an attack path and identifying victims can stretch a timeline badly. Faster notice gives members a head start against the fraud that follows a leak.

Why the Missing Card Numbers Changed the Outcome

Non-retention did the heavy lifting here. A company that never holds card numbers cannot leak them, however deep an attacker gets. Payment handling sits elsewhere, and that one architectural choice removed the most monetisable asset from the haul.

The contrast arrived the same day. Sourcenext, a Japanese software retailer, disclosed a breach of roughly 22.52 million records on October 15, and that set included passwords. Two incidents, one date, very different consequences.

Data minimisation reads like compliance language until a week like this one. Every field a business declines to store becomes a field it cannot lose. In the Burger King Japan data breach, that principle spared eleven million people from payment fraud.

The Details No One Can Reset

A password change fixes a leaked password. Nothing fixes a leaked date of birth. Names, birth dates, phone numbers and email addresses stay valid for decades, and attackers build their work around exactly that permanence.

Combined, those four fields make an approach convincing. A caller who knows your name, your birth date and the app you use sounds legitimate. Criminals then trade on that credibility to extract what they still lack, such as one-time codes, card details or account passwords.

Burger King Japan has warned members that the data taken in the breach makes impersonation easy. It pointed to fake emails, SMS messages and phone calls imitating the brand. The company told people to avoid links and attachments in unexpected messages, and never to enter member details afterwards. No fraudulent use connected to the incident has appeared so far.

A Wider Surge Against Japanese Web Systems

This incident lands in the middle of a documented campaign wave. Japan’s national CERT issued an alert on October 8 covering a run of unauthorised access incidents at domestic organisations around September. It described three access patterns. Attackers decompile published smartphone apps to pull out API endpoints and keys, reuse API keys stolen from other compromised systems, and target exposed Metabase analytics instances.

The numbers behind that alert are stark. Macnica’s security research centre counted 119 publicly disclosed incidents through October 6 in which personal data left Japanese web systems. The comparable totals were 84 for all of 2025 and 62 for 2024. Eighty-one of this year’s cases came after July.

No public evidence ties the Burger King Japan data breach to that campaign. The profile fits, because attackers targeted an app member database and moved through it inside a week. Until the company publishes a cause, though, the connection stays a pattern rather than a finding.

Japanese organisations have faced a punishing year regardless. Telecoms, cloud providers, railways, taxi operators, publishers and car-sharing services have all disclosed incidents since January. Several of those ran into the millions of records, and the Burger King Japan data breach adds eleven million more to the tally.

What Burger King App Members Should Do Now

Anyone caught in the Burger King Japan data breach should treat unexpected messages mentioning the brand as hostile. Attackers hold enough detail to personalise a scam convincingly. Open the app directly rather than following a link, and verify any offer inside it.

Change the app password if it appears anywhere else. Nobody has confirmed a password leak, but reuse turns one exposure into a chain of them. A password manager removes the memory problem behind reuse.

Watch the phone number too. Smishing campaigns follow large leaks within days, and a mobile number paired with a real name gives the sender a running start. Report suspicious texts instead of replying.

What This Means for Businesses Running Customer Apps

Loyalty apps collect more personal data than their owners realise. A member database holding birth dates, verified emails and phone numbers carries real risk, even with no payment field in sight. Businesses should audit what each field earns them, then delete the rest.

Detection speed decided the shape of this incident. Six days of access produced eleven million records, so the gap between intrusion and alarm sets the damage ceiling. Alerting on bulk reads from a member database closes that gap faster than periodic review.

The investigation into the Burger King Japan data breach continues, and the entry path should become public as it concludes. Until then, the clearest lesson sits in what the attacker could not take. Card numbers the company never stored were the only records safe by design.