Burger King Japan Data Breach: What Was Exposed

In short: Burger King Japan's official app suffered a data breach that exposed roughly 11.18 million member records, including names, email addresses, phone numbers, dates of birth and gender, after unauthorized access between October 2 and 7. The company says credit card numbers were not exposed and login password leakage has not been confirmed, but it has not said who was behind the attack.

If you have the Burger King app in Japan, here is what the company has confirmed, what it hasn't, and what to do while the investigation continues.

What personal data did the Burger King Japan breach expose?

The exposed fields include member ID, email address, name in both kanji and kana, phone number, date of birth, gender, prefecture of residence and registration type, according to Internet Watch's report on the company's October 15 announcement. Japanese reporting also lists mobile order history status and email verification status among the leaked fields. Cybernews confirms the same core set: member ID, email, name, phone number, date of birth, gender, prefecture, and registration type. No national identity number is on that list.

Credit card numbers were not stored on the affected system and were not exposed, and the company "has not confirmed the leakage of login passwords," per Cybernews. So no confirmed card numbers, no confirmed passwords — but plenty of personal detail for someone to work with.

Who was affected by the Burger King Japan data breach?

Roughly 11.18 million official app member records were affected. Burger King Japan found the unauthorized access on October 13, traced the intrusion to a window of October 2 through 7, and announced the breach publicly on October 15, according to both Cybernews and Internet Watch's account of the company notice. Affected members were notified individually by email, Cybernews reports.

What don't we know yet about who did this?

The company has not disclosed who carried out the attack or exactly how they got in. It has said it blocked the access route, according to Internet Watch's account of the company notice, and notified Japan's Personal Information Protection Commission and is "working on additional security measures," per Cybernews. At the time of disclosure, Burger King Japan said it "has not confirmed any fraudulent use of the information," and added: "We sincerely apologize for the great concern and inconvenience this has caused to our customers and all others affected," as quoted by Cybernews.

Should I worry about phishing after this breach?

Yes. Attackers now have names, phone numbers, email addresses and order-related details — enough to craft a message that looks like it genuinely comes from Burger King. The company itself has warned customers to "remain alert to suspicious emails, text messages, and phone calls impersonating the company," and advised against clicking links, opening attachments, or entering account details or passwords in response to unexpected messages, according to Cybernews. Our guide on how to recognize phishing attempts using your exposed data walks through the warning signs in more detail.

Could my password have been leaked in the Burger King Japan breach?

The company says it has not confirmed any login password leak, but "not confirmed" is not the same as "ruled out." If you reused your Burger King app password anywhere else, treat it as at risk. See what to do if your password was leaked for the steps to secure other accounts tied to the same password or email.

What should I do if my data was exposed in this breach?

Here's a checklist for anyone who uses the Burger King Japan app:

1. Expect phishing attempts. Treat unexpected texts, emails or calls claiming to be from Burger King with suspicion, even if they reference your name or order history.
2. Don't click links in unsolicited messages. Go to the app or official website directly instead, following the company's own advice reported by Cybernews.
3. Change your Burger King app password, and change it anywhere else you reused the same password, especially since password leakage hasn't been ruled out.
4. Watch your email and phone for impersonation attempts that use your real name, phone number or date of birth to sound convincing.
5. Check your bank and card statements for unusual activity, even though the company says credit card numbers were not stored on the affected system.
6. Keep the notification email you received from Burger King Japan, since it may be useful if you need to report fraud later.
7. If your country offers a credit block, use it. Residents of Denmark, for example, can register a free credit warning (kreditadvarsel) through the official citizen portal, which forces lenders to verify identity before granting credit — see Borger.dk's guidance and the Danish Agency for Digital Government's explainer.

Bottom line for now

Burger King Japan says it has blocked the access route and is working on further security measures, and as of its disclosure had seen no confirmed fraudulent use of the data, according to Internet Watch. The attacker and the method of entry remain undisclosed. Until more is known, the safest move is to assume your name, email, phone number and other profile details are in someone else's hands, and act accordingly.