Burger King Japan has confirmed a major cybersecurity breach involving approximately 11.18 million customer records after hackers gained unauthorized access to its mobile application systems. The incident has raised concerns about potential phishing attacks, identity theft, and the misuse of personal information belonging to millions of customers.
According to the company, suspicious activity was discovered on October 13, 2026, following unauthorized access to the application’s backend systems on October 2 and October 7. Burger King Japan’s security team blocked the attackers and launched an investigation to determine the extent of the breach. The company also reported the incident to Japan’s Personal Information Protection Commission and began implementing additional cybersecurity measures to prevent future attacks.
Although millions of customer records were affected, Burger King Japan stated that credit card information was not stored within the compromised system. Investigators have also found no confirmed evidence that customer login passwords were exposed or that the stolen information has been used fraudulently. However, the exposure of customer information could still create opportunities for cybercriminals to conduct targeted phishing campaigns and social engineering attacks.
Burger King Japan is urging affected customers to remain cautious of suspicious emails, text messages, and phone calls claiming to represent the restaurant chain. Cybercriminals may attempt to impersonate company representatives to steal additional personal information or account credentials. Customers should avoid clicking unfamiliar links, downloading unexpected attachments, or providing sensitive information through unsolicited communications.
The company has begun notifying affected members individually through email and is working with external cybersecurity specialists to strengthen its security infrastructure and monitoring capabilities. While the full impact of the breach remains under investigation, the incident highlights the growing cybersecurity risks associated with mobile applications and the importance of protecting customer information against unauthorized access.