Burger King Japan Exposes 11.18 Million App Members

Burger King Japan, the Japanese subsidiary of the global fast‑food chain, said a data breach had exposed personal information for about 11.18 million users of its official smartphone app. The breach, discovered in a server that handled membership data, occurred between Oct 2 and Oct 7 and was reported on Oct 15. The leaked data included member IDs, names in kanji and kana, phone numbers, email addresses, dates of birth, gender, prefecture of residence, and whether a user had verified their email or used mobile ordering. Credit‑card numbers were not stored in the affected system and no passwords were confirmed to have been exposed, though the company has not ruled out the possibility of future misuse.

After detecting the unauthorized access, Burger King Japan blocked traffic from the source, set up an incident‑response team, and notified Japan’s Personal Information Protection Commission. The company is working with external security specialists to determine how the attackers gained entry and has said it will strengthen security and monitoring. No secondary damage, such as fraud, has been confirmed, but the company urged affected customers to watch for suspicious emails, text messages and phone calls that might impersonate the chain and to avoid clicking unknown links or entering account details in response.

Potential phishing risk

Because the compromised records contain names, phone numbers, email addresses and birth dates, attackers could craft convincing phishing emails or texts that reference a customer’s real identity and prior interactions with the app. Experts warn that such data can be used to impersonate customer support or to push fake verification pages, increasing the risk of social‑engineering attacks. The incident follows a wave of breaches affecting major Japanese firms earlier in the year, including a publishing giant and a telecommunications operator, highlighting the growing threat of credential and configuration weaknesses in corporate systems.