Burger King Japan, the Japanese subsidiary of global fast food giant Burger King, reported a major data breach after attackers accessed a server containing 11.18 million customer details.
Founded in Florida in 1953, Burger King is now a multinational fast food chain with nearly 20,000 locations worldwide, including 350 in Japan.
In a news release Thursday, Burger King Japan said the follow-up investigation was completed on Oct. 13 and apologized to customers whose information was stolen and leaked online in early October.
The attacked servers stored the personal information of users of the company’s official smartphone app, including names, dates of birth, gender, email addresses, phone numbers and order history.
“We have identified potential unauthorized third-party access to the system that manages member information for our official app and have conducted an investigation.” said Burger King Japan.
“As a result, on Tuesday, October 13, 2026, it was determined that unauthorized access occurred between Friday, October 2, 2026 and Wednesday, October 7, 2026, resulting in a loss of member information. Upon becoming aware of the unauthorized access, we immediately terminated access from the source in question.”
However, the company says that no customers’ credit card numbers were stored on the compromised server and that no evidence was found that the threat actors accessed user credentials.
Burger King Japan has reported the breach to Japan’s Personal Information Protection Commission (PPC) and is now also investigating how the attackers accessed the compromised server with the help of external cybersecurity experts.
“We sincerely apologize for the great inconvenience and distress this situation has caused our customers and everyone else involved,” it added. “At this time, no consequential damages, such as fraudulent use, resulting from this incident have been confirmed.”
The fast food chain also warned affected customers to be alert for suspicious emails, text messages and phone calls that may impersonate Burger King Japan, and to avoid clicking on URLs, opening attachments or entering membership information or passwords.
This incident adds to a wave of cyberattacks that have affected several major Japanese companies since the beginning of the year, including entertainment systems maker Daiichi Kosho, cloud and digital infrastructure company IDC Frontier, Japanese publishing giant Nikkei, private railway operator Keio, car-sharing service Times Car, cloud and data center service provider Sakura Internet, taxi operator Nihon Kotsu, telecommunications giant KDDI and many others.
Macnica researcher Yutaka Sejiyama has logged 119 cybersecurity incidents This year focused on the theft or disclosure of personal information and found that attackers are now probing websites and APIs for access control, configuration and authentication vulnerabilities and exploiting known (n-day) vulnerabilities.
