Burger King Japan, the Japanese subsidiary of global fast-food giant Burger King, disclosed a major data breach after attackers accessed a server containing 11.18 million customer records.
Founded in 1953 in Florida, Burger King is now a multinational fast-food chain with nearly 20,000 locations worldwide, including 350 in Japan.
In a Thursday press release, Burger King Japan said it concluded a follow-up investigation on October 13 and apologized to customers whose data was stolen in early October and leaked online.
The breached servers stored the personal information for users of the company's official smartphone app, including their names, dates of birth, gender, email addresses, phone numbers, and order history.
"We identified a potential unauthorized third-party access to the system that manages member information for our official app and conducted an investigation," Burger King Japan said.
"As a result, it was determined on Tuesday, October 13, 2026, that unauthorized access occurred between Friday, October 2, 2026, and Wednesday, October 7, 2026, resulting in a leak of member information. Upon becoming aware of the unauthorized access, we immediately blocked access from the source in question."
However, the company says the compromised server did not store customer credit card numbers and that it found no evidence that the threat actors accessed user credentials.
Burger King Japan has reported the breach to Japan's Personal Information Protection Commission (PPC) and is now also investigating how the attackers accessed the compromised server, with help from external cybersecurity experts.
"We sincerely apologize for the great inconvenience and concern this situation has caused to our customers and all others involved," it added. "At this time, no secondary damage, such as fraudulent use, resulting from this incident has been confirmed."
The fast-food chain also warned affected customers to watch for suspicious emails, SMS messages, and phone calls that may impersonate Burger King Japan, and to avoid clicking URLs, opening attachments, or entering member information or passwords.
This incident adds to a wave of cyberattacks that have impacted several major Japanese companies since the start of the year, including entertainment system maker Daiichi Kosho, cloud and digital infrastructure firm IDC Frontier, Japanese publishing giant Nikkei, private railway operator Keio, car-sharing service Times Car, cloud and data center service provider Sakura Internet, taxi operator Nihon Kotsu, telecommunications giant KDDI, and many others.
Macnica researcher Yutaka Sejiyama has logged 119 cybersecurity incidents involving personal information theft or exposure this year and found that attackers are now probing websites and APIs for access-control, configuration, and authentication weaknesses, and exploiting known (n-day) vulnerabilities.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.