Burger King Japan breach exposes 11.18 million customer records

Burger King Japan disclosed on October 15, 2026, that approximately 11.18 million customer records were exposed in a data breach. It said the breach took place from October 2 through October 7, 2026. It acknowledged the breach internally on October 13, 2026.

It also comprises phone numbers, full names in kanji and kana, e‑mail verification status, and mobile ordering usage.

Burger King Japan stated it does not retain credit card numbers, meaning payment card data was not included in the breach. The company stated that no login passwords have been confirmed as leaked and that there is no sign of fraudulent use of the exposed data.

After detecting the breach, Burger King Japan blocked the unauthorized access, set up an internal response team, and informed Japan’s Personal Information Protection Commission. It is reaching out to affected members via e‑mail and has hired external experts to investigate how the attacker entered the system.

The mix of names, birthdates, phone numbers and e‑mail addresses could make phishing attempts more convincing. Burger King Japan warned that attackers might send fake refund notices, account alerts or security messages aiming to obtain passwords, payment information or verification codes. It said the investigation is ongoing to determine how attackers entered and which safeguards failed.

The breach occurred amid a broader wave of cyberattacks targeting Japanese companies, including Times Car and East Japan Railway Co. Other affected organizations cited in the reporting are Yamaha Motor Co., Daiwa Securities, Yakiniku King, Keio, Tokyo Metro and H.I.S.

Macnica said website or app vulnerability incidents increased from an average of six per month in the first half of 2026 to 23 per month from July 2026 onward. Sejiyama Yutaka of Macnica’s Security Research Center described the present rate of personal‑data leaks as highly unusual.

He explained that attackers are using artificial intelligence to find vulnerabilities specific to each system, allowing rapid, large‑scale attacks. He added that AI reduces the technical skill required for sophisticated intrusions, expanding the group of potential attackers.

A survey by the Japan Users Association of Information Systems encompassed more than 950 companies and revealed that 19.7% experienced data leaks due to insider misconduct or human error. The survey also suggested that some leaks might remain undetected by the affected firms.

Among companies with yearly revenue from 100 billion yen to 1 trillion yen, 78.4% said they lack sufficient cybersecurity staff. For firms with sales of 1 trillion yen or greater, 74.5% reported a similar shortage.

Macnica urged companies to locate vulnerabilities, prioritize remediation and delete any personal data that is not needed. Digital Transformation Minister Furukawa Toshiharu called for tighter collaboration between public agencies and private firms to cope with the growing threat. He also advised individuals to stop reusing passwords, activate multifactor authentication and remain alert to suspicious e‑mail messages. Goldman Sachs Alternatives owns BK Japan Holdings Co., Ltd., which operates Burger King in Japan.