The short version
- Records exposedAbout 11.18 million
- WhoBurger King Japan app members
- Unauthorized accessOctober 2 – 7, 2026
- Data leakedName, email, phone, birth date and more
- Card numbersNot stored in this system
- PasswordsNo leak confirmed
Burger King Japan confirmed on October 15, 2026 that an unauthorized third party accessed the system holding member data for its official app, exposing about 11.18 million records. The data includes names, email addresses, phone numbers, dates of birth, gender and prefecture. The company says it does not store credit card numbers in that system, and when it announced the breach it had found no sign that login passwords leaked or that anyone had misused the data.
The real danger now is not your card. It's convincing fake messages and calls that use your real name and number. If you use the Burger King Japan app, treat any email, SMS or call that claims to be from Burger King with suspicion, don't click links in them, and turn on two-factor sign-in for your email account.
What happened
Burger King's app in Japan is run by BK Japan (株式会社ビーケー・ジャパン). Its official notice and reporting by INTERNET Watch and BleepingComputer give this timeline:
| Date (2026) | What happened |
|---|---|
| October 2 – 7 | An outside party accessed the system that manages member information for the Burger King Japan app. |
| October 13 | The company's investigation confirmed that member data had leaked. |
| October 15 | Burger King Japan announced the breach, reported it to Japan's privacy regulator, and began emailing affected members. |
The company says it has blocked access from the source of the attack and is investigating how the attackers got in with outside security experts. As of the announcement, it had not named the attackers, said whether ransomware was involved, or explained the exact weakness that was used.
What data was leaked
The company's notice lists ten pieces of information about each member. Here's what each one means for you:
| Leaked item | Why it matters |
|---|---|
| Full name (kanji and katakana) | Lets scammers address you by name, which makes fake messages far more believable. |
| Email address | The main target for fake "Burger King" emails and for credential stuffing on other sites. |
| Phone number | Opens the door to scam SMS (smishing) and phone calls pretending to be support staff. |
| Date of birth | Often used as a security question or ID check. Combined with your name and phone, it helps someone impersonate you. |
| Gender | Low risk alone, but adds detail to a profile of you. |
| Prefecture | Lets scammers mention your region, for example a "local store" offer. |
| Member ID | Could appear in a fake message to make it look official. |
| Registration type | Shows how the account was created. Low risk. |
| Mobile order use | Tells a scammer you order through the app, so an "order problem" message is more likely to fool you. |
| Email verification status | Tells attackers which addresses are real and in use. |
What was not leakedCard numbers: Burger King Japan says it never stored them in this system. Login passwords: no leak had been confirmed at the time of the announcement. Order contents and payment history were outside the affected system.
Who is affected
Anyone who registered for the official Burger King Japan app. Customers who only paid in a restaurant without an app account are not part of this data breach. With 11.18 million records, a large share of Burger King's app users in Japan should assume their details are in it.
Watch out for fake breach noticesBurger King Japan is emailing affected members, and scammers know people are expecting that email. Never click a link in a breach email. Open the app or type the official website address yourself instead.
The real risks for you
1. Fake Burger King messages
The company's own warning is about this. Expect emails or SMS like "Your coupon is about to expire", "There's a problem with your mobile order" or "Confirm your account after the security incident", with a link to a fake login page. That's classic phishing, made more convincing because it uses your real name and member details.
2. Scam phone calls
Someone who knows your name, birth date and phone number can call pretending to be Burger King, your bank or your mobile carrier, and "confirm" those details to win your trust before asking for a code or payment.
3. Attacks on your other accounts
Passwords weren't confirmed leaked, but your email address now sits on a fresh list. Attackers try leaked emails with common passwords across other sites. If you reuse a password anywhere, those accounts are at risk.
4. SIM swap attempts
Name, birth date and phone number are the details used to trick a carrier into moving your number to a new SIM, a scam known as SIM swapping. Once someone controls your number, they can receive your SMS login codes.
What to do now
- Don't click links in any Burger King message for now. Open the app directly or type
burgerking.co.jpinto your browser. If a link looks suspicious, paste it into our free phishing link detector before opening it. - Never share codes or passwords on a call. Burger King won't call you to ask for a verification code, a password or a payment. Hang up and contact the company through its official website.
- Change your password if you reused it. The Burger King password wasn't confirmed leaked, but if you used the same password on any other site, change it there. Create a unique one with our password generator and test old ones with the password checker.
- Turn on two-factor sign-in for your email. Your inbox is the key to every other account. Use an authenticator app rather than SMS where you can.
- Add a PIN to your mobile account. Ask your carrier to require a PIN or in-store ID before any SIM change.
- Watch for unusual activity. Look for unexpected password reset emails, login alerts or messages you don't recognise over the next few months. Breach data gets reused long after the news fades.
- Delete the account if you don't use it. An app account you no longer need is just stored data waiting for the next breach. If you keep it, give it a unique password.
How to spot a fake "Burger King" message
- Urgency: "Your account will be suspended in 24 hours" or "Claim your compensation coupon today".
- A link to log in or "verify": real breach notices tell you what happened; they don't need you to sign in through a link.
- A slightly wrong web address: extra words, hyphens or odd endings, such as
burgerking-jp-support.cominstead ofburgerking.co.jp. - Requests for card details or codes: the breach didn't involve cards, so there's no reason to "re-enter" them.
- Prize or refund offers: free meals or refunds "for the inconvenience" are a common bait after big breaches.
Not in Japan? Why this still matters
This breach only affects the Japanese app, but the lesson applies to every food delivery, coffee and loyalty app on your phone. Each one stores your name, email, phone number and often your birth date, and each one is a target. Before signing up for a loyalty app, ask whether a discount is worth handing over that profile. Where you can, use an email alias and skip optional fields like your birth date. For more on how apps collect and share data, see our guide on how apps track you.
What we still don't know
- How the attackers got in. Burger King Japan says the investigation is ongoing.
- Who was behind it, and whether the data is being sold or shared.
- Whether passwords are fully safe. The company said no password leak had been confirmed at the time.
Frequently asked questions
Was my credit card leaked in the Burger King Japan breach?
No, according to the company. Burger King Japan says the affected system does not store credit card numbers, and order contents and payment history were outside it. Still, be wary of any message asking you to "re-enter" card details.
Were Burger King app passwords leaked?
Burger King Japan said it had not confirmed any leak of login passwords at the time of its October 15, 2026 announcement. If you reused that password on other sites, change it there as a precaution.
How do I know if my data was part of the breach?
The company is emailing affected app members. Because scammers send fake breach notices too, confirm any notice by opening the official app or typing the official website address yourself rather than clicking a link.
Should I delete my Burger King Japan app account?
If you don't use it, yes. Deleting unused accounts reduces how much of your data is stored. If you keep using it, set a unique password and stay alert for fake messages.
Does this affect Burger King customers outside Japan?
No. The breach involved the Japanese app's member system run by Burger King Japan. Customers in other countries were not reported as affected.
