Burger King Japan Discloses Breach Affecting 11.18 Million Customer Records

In a breach notification letter, the Japanese subsidiary of Burger King said it identified potential unauthorized third-party access to the member-information system and investigated. It determined that unauthorized access took place during the five-day period and resulted in a leak of member information. The company said it immediately blocked access from the source in question after becoming aware of the intrusion.

The investigation found that the exposed records mostly belonged to users of the company's official smartphone app. The data included names, dates of birth, genders, email addresses, phone numbers and order histories. Credit card and other payment data was not exposed, but TechRadar reported that the personally identifiable information is still enough to support convincing phishing emails and could escalate to business email compromise, malware or ransomware attacks.

Burger King Japan said there is no evidence so far that the data has been misused and that the breach was reported to Japan's Personal Information Protection Commission. "We sincerely apologize for the great inconvenience and concern this situation has caused to our customers and all others involved," the company said, adding that no secondary damage such as fraudulent use had been confirmed.

TechRadar reported that the incident follows an earlier breach at Burger King's Russian arm. In 2024, the company told local media about an attack on Mindbox, a domestic marketing automation platform it had been using. Through Mindbox, unknown threat actors obtained sensitive company data, including customer information, and that data leaked online in late September this year. Burger King said at the time that payment details were not among the personal data and that open transaction information was not transmitted or stored by third parties. The attack details were not disclosed.

In its 2024 results announcement, Mindbox said the attack was its "first serious information security incident" and was quickly detected and contained. The company said it found and eliminated points where employees without access rights to sensitive data could indirectly obtain it, suggesting the attack was identity-based rather than a zero-day exploit. Mindbox also said it changed development processes, reformed its internal role system to make permissions stricter and more granular, limited project access scenarios, introduced a mechanism for confirming access by another employee and made two-factor authentication mandatory, among other measures.

TechRadar reported that Have I Been Pwned?, a website that aggregates information stolen in hacks and helps people check whether their email addresses and other information have been compromised, lists Burger King Russia but not Burger King Japan.

Editor's Summary

Burger King Japan has reported a breach of 11.18 million app-related customer records, with names, contact details and order histories exposed but no payment data. The company says it blocked the access, notified Japan's Personal Information Protection Commission and has found no confirmed misuse. The incident follows a 2024 breach at Burger King Russia through marketing platform Mindbox, whose data leaked online in late September 2026.