The Burger King data breach reached the membership system behind the chain's official app in Japan, and the operator says about 11.18 million member records were exposed. BK Japan, the company that runs Burger King restaurants and the app in Japan, found the intrusion on October 13 and disclosed it publicly on October 15, according to CyberInsider.
The story is Japanese first. The affected members use an app that BK Japan operates there, and the public reporting so far shows no American accounts involved. The US angle is narrower but real. The exposed records are the kind of contact details criminals use to make phishing messages look like they came from a brand a customer already trusts.
What BK Japan says happened
According to the company, an unauthorized party reached the system that manages app membership data. The intruder had access between October 2 and October 7, 2026, and BK Japan says the access was blocked once it identified the source. Other outlets, including Gadget Review, reported the same timeline.
BK Japan has reported the incident to Japan's Personal Information Protection Commission and is working with outside cybersecurity specialists. The company has not named the attack method, and the external investigation is still under way. That gap matters, because the entry point determines whether other systems tied to the app face the same exposure.
The most direct statement on record comes through a secondary source. In its official data breach notification, as quoted by Security Affairs, BK Japan said: "We have confirmed that customer membership information from the official app has been leaked externally." Readers should treat that wording as quoted, since the original notice was not available for this report.
Burger King data breach: which fields were exposed
Reports list the exposed fields as follows:
- Member IDs
- Names written in kanji and kana
- Email addresses and phone numbers
- Dates of birth and gender
- Prefecture of residence
- Registration type
- A flag showing whether the member has mobile-order history
- An email-verification flag
No single field on that list opens a bank account. Combined, they describe a real customer closely enough to write a believable message. A message that references an actual membership is far harder to dismiss than a generic prize notice.
BK Japan says credit card numbers were not stored on the affected system, and Pasquale Pillitteri's report repeats that point. That detail limits the direct financial exposure, though it does not remove the phishing risk.
Passwords are less settled. The company says it has not confirmed a password leak. Cybernews describes the password question as unconfirmed rather than ruled out. The wording differs elsewhere: one report says no credentials were confirmed stolen, according to BigGo Finance, and another says the company found no evidence of credential access, as reported by daily.dev. Those phrasings are not identical, and "not confirmed" should not be read as "never happened."
On fraud, the picture is clearer. No fraudulent use has been confirmed so far. The company has warned customers to watch for suspicious emails, texts and calls that impersonate Burger King, and OffSeq Radar, citing BleepingComputer, reported the same warning.
Why the 11.18 million figure needs context
The headline number counts records, not people. Pillitteri's coverage makes the distinction plain: the 11.18 million figure is not a verified count of unique individuals. One person can hold more than one record, so the number of people affected could be lower than the headline suggests. Nothing in the public reporting settles that question yet.
A smaller head count does not make the exposure harmless. Readers should not assume the figure equals every member of the app, and they should not assume a smaller count shrinks the risk to each person whose record was copied.
The breach also lands in a crowded year for Japan. daily.dev notes a run of major 2026 breaches, including incidents involving Nikkei, KDDI, Sakura Internet and Times Car. The public record does not link those cases to this one, but the pattern makes this look less like a single failure and more like one entry in a longer list.
What the breach means for US readers
Burger King is an American hamburger chain. In Japan, though, its restaurants and app are run by BK Japan, which is why the breach is not a US disclosure and why American customers should not expect a notice from a US regulator. The US tie is the brand, not the database.
The lesson still travels. Loyalty and mobile-ordering apps collect contact details, birthdays and order history, often more than members think they are sharing. Many Americans carry accounts with fast-food, coffee and retail apps, and a leak at any one of them can outlive the incident that caused it.
USA 24 has already covered the impersonation side of this pattern. In our report on fake Microsoft security alerts, scammers used a trusted name and a believable warning to pull victims toward a fake support flow. A Burger King message that cites a real membership removes much of the suspicion a generic alert would trigger.
The same logic applies outside retail. Our coverage of the California student data breach at ETS describes millions of exposed records. Once contact data leaves a system, the danger comes from how it is used later.
How to protect yourself after a Burger King app breach
The steps below apply whether you live in Japan or the United States, and they work for any restaurant or loyalty app.
- Treat any unexpected email, text or call that mentions a Burger King account as suspicious, even if it includes your name or a real order detail.
- Do not click links in those messages. Open the official app or type the brand's web address into your browser yourself.
- Never share a verification code, password or card number with someone who contacted you first. Hang up and call back using a number from the official website.
- Change your Burger King app password as a precaution, even though the company has not confirmed a password leak.
- If you reuse that password anywhere else, change those accounts too, and turn on two-factor authentication wherever it is offered.
- Review bank and card statements regularly, and report any charge you do not recognize to your card issuer.
What to watch next
Four open questions will decide how serious this breach becomes. First, whether BK Japan names the attack method once its outside specialists finish their work. Second, whether the company confirms or rules out credential exposure, which would settle the password question. Third, whether it publishes a count of unique members separate from the 11.18 million records. Fourth, whether the stolen data appears on criminal forums or marketplaces, which the reporting so far does not verify.
Watch the scam traffic too. If phishing messages that cite Burger King start appearing in English as well as Japanese, that would suggest the data is moving beyond Japan, and US customers would have a direct reason to take the warnings seriously.
