Roughly 11.18 million people with the Burger King Japan app have been told their personal records were taken from the membership system that serves them. Intruders were inside that system from October 2 through October 7, 2026. An internal review turned up the leak on October 13, and the chain went public two days later, filing a report with Japan’s Personal Information Protection Commission at the same time.
The records reach well beyond a name
Membership identifiers and email addresses are part of the haul, as are names written in kanji and in kana. So are phone numbers, birth dates, gender, the prefecture each member lives in, and the type of registration on file. Two further details leaked: whether a customer has ordered through the mobile app, and whether their email was ever verified.
Credit card numbers, the chain says, are not stored at all, and investigators found no indication that passwords escaped. Nobody has reported fraud tied to the intrusion so far.
Where the danger actually sits
Contact data alone is enough for a convincing con. A text or call naming the customer, their birthday, and the prefecture they live in carries a specificity that generic scams lack, and that is precisely why it lands over SMS, email, or voice.
Access from the source of the rogue traffic has been cut, according to the company, which also formed an incident response team and is bringing in interim safeguards while outside specialists examine the cause. No account of how the intruder got in has been published.
Members are being urged to assume hostile intent behind any message about an account, a points balance, or a problem with an order. The chain’s own guidance: never open an unverified link or attachment, and never re-enter login details in response to a message.
