- Burger King Japan discloses breach affecting 11.18 million customer records from its mobile app platform
- Exposed data included personal details and order histories, though payment information was not compromised
- Company reported no confirmed misuse and notified regulators while investigating the intrusion
The Japanese subsidiary of Burger King has confirmed suffering a data breach and apologized for losing sensitive data on millions of customers.
In a breach notification letter, Burger King Japan confirmed the exact date of the breach, as well as the nature of the data that was stolen.
"We identified a potential unauthorized third-party access to the system that manages member information for our official app and conducted an investigation," the company said in the letter. "As a result, it was determined on Tuesday, October 13, 2026, that unauthorized access occurred between Friday, October 2, 2026, and Wednesday, October 7, 2026, resulting in a leak of member information. Upon becoming aware of the unauthorized access, we immediately blocked access from the source in question."
Echoes of Russia
The investigation determined that 11.18 million customer records were nabbed, which was mostly data on people using the company’s official smartphone app.
It includes people’s names, dates of birth, genders, email addresses, phone numbers, and order histories. While credit card and other payment data was not exposed, personally identifiable information (PII) is still more than enough to launch convincing phishing emails and escalate to business email compromise (BEC), malware, or even ransomware attacks.
Burger King Japan stressed that there is no evidence of data misuse yet and added that the breach was reported to the country’s Personal Information Protection Commission (PPC).
"We sincerely apologize for the great inconvenience and concern this situation has caused to our customers and all others involved," it added. "At this time, no secondary damage, such as fraudulent use, resulting from this incident has been confirmed."
Burger King’s food isn’t the only tasty thing about the company, it seems. Cybercriminals also love breaking in and stealing data. Back in 2024, for example, the Russian arm of Burger King suffered a data breach at the hands of unknown threat actors and in late September this year, that data leaked online.
In October 2024, Burger King told local media about an attack on Mindbox, a domestic marketing automation platform the company had been using. Through Mindbox, the threat actors managed to obtain sensitive company data, including information belonging to the customers.
"Among the victims of the attack may also be the data of customers of the Burger King restaurant chain," the company said at the time. “Burger King confirms that among the personal data, the accuracy of which is being clarified, there is no information about payment details: open information about transactions is not transmitted or stored by third parties.”
Just like in the Japan incident, the Russia one did not discuss the details of the attack, or how it was pulled off. Third-party supply chain attacks are common and often rather disruptive, affecting numerous companies using the same tools. For Mindbox, however, there have been no reports of additional victims.
Supply chain attacks
In its 2024 results announcement, Mindbox said the attack was its “first serious information security incident”, which was quickly detected and contained “thanks to threat detection tools.”
In the aftermath of the breach, Mindbox said it “found and eliminated points where employees without access rights to sensitive data could indirectly obtain them,” hinting that the attack was, in fact, an identity-based attack rather than a zero-day exploit.
The company also “changed development processes to find such points before they get into the product,” and reformed Mindbox's internal role system to make permissions stricter and more granular. It also limited project access scenarios, introduced a mechanism for confirming access by another employee, and introduced mandatory two-factor authentication, among other things.
Have I Been Pwned?, a website that aggregates information stolen in various hacks and helps people learn if their email addresses and other information had been compromised in the past, has Burger King Russia on its list, but not Burger King Japan.
Via BleepingComputer