Breach · · 3 min read
Burger King Japan says 11.18 million app records were leaked
The official app’s member system was accessed from October 2 to 7. Names, emails, phone numbers and birth dates were in the copy. Card numbers were not stored there.
On October 15, 2026, BK Japan, the company that runs Burger King in Japan, said an outsider had accessed the system that holds members of the official Burger King app. The company says about 11.18 million member records were copied. If you have never used that Japanese app, this one does not include you.
What was in the records
BK Japan’s notice (PDF, in Japanese) says the unauthorized access ran from Friday, October 2, through Wednesday, October 7, and that the leak was confirmed on Tuesday, October 13. The company says it then blocked the source of that access.
The notice lists the copied fields as:
- member ID
- email address
- registration type
- prefecture
- gender
- date of birth
- name, in kanji and kana
- phone number
- whether the member had a mobile-order history
- whether the email address had been verified
It says Burger King Japan does not hold credit card numbers, so those were not in the leak. It also says it has not confirmed that login passwords were copied, and that it has not seen misuse that it can tie to this incident. The way the outsider got in is still under investigation with an outside firm. The company says it has reported the breach to Japan’s Personal Information Protection Commission and is emailing affected members.
What to do if you used the app
- Don’t follow a link in a message about this leak. The notice asks people to ignore suspicious email, text messages, and phone calls pretending to be Burger King or the app, and not to open attachments or type a password because of them. The company’s own page is burgerking.co.jp.
- A password reset is still reasonable. The company has not confirmed that passwords were copied. Resetting the app password, and any other account that reused it, closes the case where that confirmation is wrong.
- Watch the email address on the account. A name, a phone number, a birth date, and an email in one record is enough for a targeted message. For how that usually shows up, see how scammers use leaked data.
- If you only eat at Burger King outside Japan, you can stop. This notice is about the Japanese official app’s member system, not a global restaurant database.
How Frame helps
Frame keeps a catalog of known breaches and lets you add the ones you know you were part of to a verified email. Frame shows what each one exposed, gives you a short checklist, and counts it in your exposure report. Automatic breach lookups aren’t live yet. We never collect or store the leaked records themselves.
Sources
- BK Japan, Apology and notice regarding the leak of official-app member information, October 15, 2026
- BK Japan, News list, October 15, 2026
- NHK, About 11.18 million Burger King app member records leaked, October 15, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.