Burger King Japan data breach exposes 11 million customer records

[Falcon]

Burger King Japan has revealed that attackers accessed a server holding 11.18 million customer records, and the data was later leaked online. BleepingComputer's Sergiu Gatlan reports that the access happened between 2 and 7 October 2026. The company announced the breach on 15 October after finishing a follow up investigation on 13 October

Users of the official Burger King Japan app are affected. The exposed data includes names, dates of birth, gender, email addresses, phone numbers and order history. That is a lot of personal information, even if it does not include the most sensitive financial details

The company says card numbers were not stored on the affected server, and it has no evidence that passwords were accessed. It has blocked the source of the access, reported the breach to Japan's Personal Information Protection Commission and is investigating with outside security experts. No attacker has been named

Burger King Japan is warning customers to watch out for phishing emails, text messages and phone calls pretending to be from the company. That is sensible advice, because names, phone numbers and order histories make scam messages much more convincing. A security researcher has counted 119 personal data incidents in Japan so far this year

Fast food apps collect a surprising amount of personal data, often more than people realise. This breach is a reminder to be careful about which apps we share information with. Customers should be on the lookout for convincing scams over the coming weeks

How much personal information do you share with food ordering apps? And should companies keep less customer data in the first place?

Burger King Japan data breach exposes 11 million customer recordswww.bleepingcomputer.com