Burger King Japan said an unauthorized third party accessed a server holding member information from its official app between Friday, October 2 and Wednesday, October 7, 2026. The company said it concluded a follow-up investigation on October 13 and that the stolen data had leaked online.
The exposed records covered approximately 11.18 million app users and included names, dates of birth, gender, email addresses, phone numbers and order history. The company said the compromised server did not store credit card numbers and that it found no evidence that user credentials were accessed.
"We identified a potential unauthorized third-party access to the system that manages member information for our official app and conducted an investigation," Burger King Japan said in a Thursday press release. It added that it blocked access from the source as soon as it became aware of the intrusion.
The company has reported the breach to Japan's Personal Information Protection Commission and is working with external cybersecurity experts to determine how the attackers accessed the server. It said no secondary damage, such as fraudulent use of the stolen data, had been confirmed.
"We sincerely apologize for the great inconvenience and concern this situation has caused to our customers and all others involved," the company said.
Burger King, founded in Florida in 1953, operates nearly 20,000 locations worldwide, including about 350 in Japan. The fast-food chain warned affected customers to watch for suspicious emails, text messages and phone calls impersonating Burger King Japan, and to avoid clicking links, opening attachments or entering member information.
The incident adds to a wave of cyberattacks on major Japanese companies this year, including entertainment system maker Daiichi Kosho, cloud firm IDC Frontier, publisher Nikkei, railway operator Keio, car-sharing service Times Car and cloud provider Sakura Internet.