Key takeaways

  • BK Japan (ビーケー・ジャパン), which runs Burger King in Japan, says attackers accessed the system that manages members of its official app between October 2 and 7, 2026, and took data on about 11.18 million members.
  • The data: names (in kanji and katakana), phone numbers, email addresses, dates of birth, sex, prefecture and member IDs, plus whether each member had used mobile ordering.
  • Card numbers were not held. Leaks of login passwords have "not been confirmed", the company says.
  • It found the breach on October 13, six days after the access ended, and announced it on October 15. How the attackers got in is still under investigation.
  • It is one of the largest breaches in Japan this year, and the latest of several large breaches of app member systems.

What happened#

Date (2026) Event
Oct 2 (Fri) to Oct 7 (Wed) Unauthorized access to the system that manages app members' information
Oct 13 (Tue) After seeing signs of possible unauthorized access and investigating, BK Japan confirms that member data leaked
Oct 15 (Thu) Public notice. BK Japan says it blocked the source of the access, put interim measures in place, set up a response headquarters and reported to the Personal Information Protection Commission

The notice does not say how the attackers got in, or how the company first noticed. It says the cause, and how the access became possible, are being investigated with outside specialists. It also says no misuse of the data has been confirmed so far.

What was taken#

Data Status
Name (kanji and katakana reading) Taken
Phone number, email address Taken
Date of birth, sex, prefecture Taken
Member ID, registration type, whether the email address was verified Taken
Whether the member had used mobile ordering Taken
Credit card numbers Not held by BK Japan
Login passwords Leak "not confirmed at this time"

About 11.18 million member records are affected. BK Japan does not say how many people that is, or whether it includes inactive or deleted accounts. Affected members will be contacted by email.

What we don't know yet#

BK Japan has not said:

  • How the attackers got in: through the app's API, another part of the system, or a contractor
  • How passwords were stored, and why their leak is "not confirmed" rather than ruled out
  • How it noticed the access, and why it took until October 13, six days after the access ended
  • How many people the 11.18 million records represent
  • Whether it has reported to the police

Our analysis#

Another app member system#

Burger King's is the latest in a run of large breaches of app and membership systems in Japan this autumn. On the same day, software maker SourceNext said a member information API had been abused to take data on about 22.5 million members. Before that came the restaurant chain Yakiniku King, whose app lost data on about 10.79 million members, and Lawson ID. Burger King now sits near the top of our list of 2026's largest breaches.

BK Japan has not said how the attackers got in. But the timing and the target fit what Japan's responders have described. NICT named the A2B (app-to-backend) attack, in which attackers analyse a public app to find and abuse the servers behind it. On October 15, JPCERT/CC said it had found attackers' servers full of Android app files and app reverse engineering tools. In our view, Burger King's case fits that profile, but this is an inference: neither BK Japan nor any agency has linked them.

"Not confirmed" is not "not leaked"#

On card numbers, BK Japan is definite: it does not hold them, so they could not leak. On passwords, it says only that a leak "has not been confirmed at this time". That wording describes the state of an investigation, not of the data, as we saw at Moonstar. Until BK Japan explains how passwords were stored and whether the attackers could reach them, members should assume the worst and change any password they reused.

Why does a burger app need a birth date?#

The leaked fields are worth reading as a list. To order a burger, an app needs very little. This one held members' full names with readings, phone numbers, birth dates, sex and prefecture, for over 11 million people. Some of that supports marketing, birthday coupons or age checks. All of it is now useful to fraudsters, who can combine a name, phone number and birth date into a convincing call or message.

In our view, cases like this show why companies should assume their app's backend will be attacked, and decide what to collect on that basis. Data that is never collected cannot leak. Japan has an unusually large number of store-by-store points and membership apps, each holding a copy of customers' personal details. Every one of them is a target, and not every operator can defend an internet-facing API at the level these attacks require.

What this means for readers#

  • If you run a consumer app, review what personal data its backend actually needs, and stop collecting the rest. Check that every API endpoint enforces server-side authorization and is rate-limited, and decompile your own app to see what an attacker would find.
  • If you have a Burger King Japan app account, expect phishing calls, texts and emails that use your name, phone number and birth date. Change your password if you used it anywhere else.
  • If you monitor brand abuse, expect fake Burger King coupon and "account problem" messages to follow this breach.

Japanese terms at a glance#

Japanese Reading Meaning
ビーケー・ジャパン Bī Kē Japan BK Japan, operator of Burger King in Japan
公式アプリ会員 kōshiki apuri kaiin Official app members
外部に漏えいしたことを確認 gaibu ni rōei shita koto o kakunin Confirmed that data leaked outside
登録種別 tōroku shubetsu Registration type
モバイルオーダー mobairu ōdā Mobile ordering
漏えいは現在確認されておりません rōei wa genzai kakunin sarete orimasen A leak has not been confirmed at this time
二次被害 niji higai Secondary harm (misuse of leaked data)

We will update this article when BK Japan publishes the results of its investigation.