---
title: Burger King Japan: ~11.18M official-app member records exposed after Oct 2–7 unauthorized access | ctxsec
url: https://ctxsec.com/items/burger-king-japan-breach-2026-10
description: ""
status: "confirmed (vendor)"
published: 2026-10-15
---

> 

[← Cybersecurity News](/news) · [markdown](/items/burger-king-japan-breach-2026-10.md)

confirmed (vendor)

2026-10-15

### Burger King Japan: ~11.18M official-app member records exposed after Oct 2–7 unauthorized access

BK Japan (ビーケージャパン) published an apology notice on Oct 15 confirming unauthorized access to the system that holds official-app member data. Intrusion ran Oct 2–7 and was discovered Oct 13; the company blocked the source and reported to Japan's Personal Information Protection Commission. About 11.18 million records are in scope: member IDs, emails, registration type, prefecture, gender, date of birth, names (kanji/kana), phone numbers, and flags for mobile-order history and email verification. The company says it does not store card numbers and has not confirmed password leakage or secondary misuse. Cause is still under investigation with an external specialist. Affected users should treat phishing SMS/email impersonating Burger King as high risk.

Sources: [BK Japan apology PDF (Oct 15)](https://www.burgerking.co.jp/images/notice/2026/10/15/d4d114ca-ebd7-4f3d-94ef-c4ea7a84a139.pdf) · [Kyodo English](https://english.kyodonews.net/articles/-/88323)