Burger King Japan has confirmed that unauthorized access to its mobile app platform exposed the personal data of 11.18 million customers, making it one of the largest fast-food breaches ever recorded in the country.

The company said it detected suspicious activity on October 13, 2026, and traced the intrusion back to a five-day window beginning October 2. Access from the source was blocked immediately, according to a breach notification letter released by the subsidiary.

What You Need to Know

The breach affects users of Burger King Japan's official smartphone app, with exposed data including names, dates of birth, genders, email addresses, phone numbers and order histories. Payment card details were not compromised. The company has reported the incident to Japan's Personal Information Protection Commission and says no confirmed misuse has occurred so far. The incident echoes a 2024 breach at Burger King Russia, where attackers gained access through a third-party marketing platform called Mindbox.

A Familiar Pattern in Fast-Food Security

The Burger King Japan breach arrives less than two years after a similar incident at Burger King Russia, where unknown threat actors compromised customer data through Mindbox, a domestic marketing automation platform the chain had been using.

That earlier attack, disclosed in October 2024, was described by Mindbox as its "first serious information security incident." The company later revealed that the intrusion exploited identity-based access gaps rather than a software vulnerability, allowing employees without direct data permissions to indirectly obtain sensitive information.

Mindbox responded by tightening internal role systems, introducing mandatory two-factor authentication and reforming development processes to catch permission flaws before deployment. Whether Burger King Japan's platform shared any infrastructure or vendor relationships with the Russian operation remains unclear.

What Was Taken and What Was Not

According to the notification letter, the stolen records consist primarily of personally identifiable information linked to app users. The data set includes:

  • Names and dates of birth: Core identity markers that enable targeted phishing and account takeover attempts.
  • Contact details: Email addresses and phone numbers that give attackers direct channels for fraud.
  • Order histories: Behavioral data revealing purchasing patterns, locations and frequency of visits.
  • Demographic information: Gender data that can be cross-referenced with other leaked databases.

Payment card numbers and financial transaction records were not part of the exposed data set, according to Burger King Japan. That distinction limits the immediate risk of direct financial fraud but does not eliminate the threat posed by the leak.

Security researchers note that personally identifiable information alone is sufficient to launch convincing phishing campaigns, escalate to business email compromise or deploy malware and ransomware. The combination of names, birth dates and order histories creates a detailed profile that makes social engineering attacks far more credible.

Why This Matters

The breach places Burger King Japan at the center of a growing accountability problem for restaurant chains that collect vast troves of customer data through loyalty apps and digital ordering systems. Unlike banks or healthcare providers, fast-food companies often lack the regulatory scrutiny and security infrastructure that traditionally accompany sensitive data handling.

Customers whose data was exposed now face a heightened risk of targeted fraud for years to come. Order histories and birth dates cannot be changed the way passwords can, leaving victims with limited options for protecting themselves.

For the broader fast-food industry, the incident raises uncomfortable questions about whether mobile app platforms are receiving adequate security investment relative to the volume of personal data they accumulate. The Japanese subsidiary's disclosure to the Personal Information Protection Commission may trigger closer examination of how restaurant chains handle consumer information across the region.

Burger King Russia's experience offers a cautionary precedent. That breach remained undisclosed in detail for months, and the leaked data eventually surfaced online in late September 2026. Have I Been Pwned?, the breach aggregation service, lists Burger King Russia but has not yet added Burger King Japan to its database.

Regulatory Pressure Builds in Japan

Japan's Personal Information Protection Commission has received formal notification of the incident. The regulator has increasingly focused on corporate data governance in recent years, particularly as digital ordering and loyalty programs expand across the food service sector.

Burger King Japan said in its letter that no secondary damage such as fraudulent use has been confirmed. The company apologized for what it called "great inconvenience and concern" caused to customers and others involved.

The investigation into how the intrusion occurred is ongoing. Neither Burger King Japan nor its parent company has indicated whether the attack originated from an external actor, an insider threat or a compromised vendor relationship.