INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Burger King Japan Experiences Data Breach Impacting 11.18 Million Records

| 2026-10-16 10:03 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
A data breach occurred between October 2 and 7, exposing emails, birth dates, and other personal information from nearly 12 million app members of Burger King Japan. The breach was attributed to a third-party access to BK Japan's membership system, but the company has not disclosed how the attacker gained access. The exposed data includes customers' names in kanji and kana, phone numbers, email addresses, dates of birth, gender, prefecture, and member IDs, as well as registration details and information about mobile ordering. As a result, affected customers may face more convincing phishing attempts with their personal information. Researchers have warned that the risk extends beyond the initial breach, citing potential follow-on threats such as impersonation by scammers using stolen account details to create fake verification pages.
Technical Mitigations AI-generated
• Limit access to member databases and detect unusual bulk retrieval • Establish a response team after identifying unauthorized access • Block connections from the source involved in the breach
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
JP
hospitalityhospitality
Incident Timeline
‎October 2
Threat actors exploited vulnerabilities between October 2 and 7 to expose emails, birth dates, and other data from nearly 12 million app members.
target_region Japan
The Burger King Japan data breach occurred between October 2 and 7, exposing emails, birth dates and other data from nearly 12 million app members.
tactic Data Breach
The Burger King Japan data breach occurred between October 2 and 7, exposing emails, birth dates and other data from nearly 12 million app members.
general_metric 7 October
The Burger King Japan data breach occurred between October 2 and 7, exposing emails, birth dates and other data from nearly 12 million app members.
data_breach 12 app members
The Burger King Japan data breach occurred between October 2 and 7, exposing emails, birth dates and other data from nearly 12 million app members.
‎between October 2
Threat actors exploited vulnerabilities in the Burger King Japan app between October 2 and 7, resulting in the exposure of approximately 11.18 million member records.
general_metric 7 October
The company, operated by BK Japan Holdings Co., Ltd.and owned by Goldman Sachs Alternatives, disclosed the breach on October 15 in a press release, stating that the breach took place between October 2 and 7 while it discovered the leak on October 13.
source_region Japan
The company, operated by BK Japan Holdings Co., Ltd.and owned by Goldman Sachs Alternatives, disclosed the breach on October 15 in a press release, stating that the breach took place between October 2 and 7 while it discovered the leak on October 13.
organisation BK Japan Holdings Co.
The company, operated by BK Japan Holdings Co., Ltd.and owned by Goldman Sachs Alternatives, disclosed the breach on October 15 in a press release, stating that the breach took place between October 2 and 7 while it discovered the leak on October 13.
organisation Ltd.and
The company, operated by BK Japan Holdings Co., Ltd.and owned by Goldman Sachs Alternatives, disclosed the breach on October 15 in a press release, stating that the breach took place between October 2 and 7 while it discovered the leak on October 13.
organisation Goldman Sachs Alternatives
The company, operated by BK Japan Holdings Co., Ltd.and owned by Goldman Sachs Alternatives, disclosed the breach on October 15 in a press release, stating that the breach took place between October 2 and 7 while it discovered the leak on October 13.
‎October 13
Threat actors exploited vulnerabilities in BK Japan Holdings Co., Ltd.'s systems to leak 11.18 million app member records between October 2 and 7, which were discovered on October 13.
general_metric 7 October
The company, operated by BK Japan Holdings Co., Ltd.and owned by Goldman Sachs Alternatives, disclosed the breach on October 15 in a press release, stating that the breach took place between October 2 and 7 while it discovered the leak on October 13.
source_region Japan
The company, operated by BK Japan Holdings Co., Ltd.and owned by Goldman Sachs Alternatives, disclosed the breach on October 15 in a press release, stating that the breach took place between October 2 and 7 while it discovered the leak on October 13.
organisation BK Japan Holdings Co.
The company, operated by BK Japan Holdings Co., Ltd.and owned by Goldman Sachs Alternatives, disclosed the breach on October 15 in a press release, stating that the breach took place between October 2 and 7 while it discovered the leak on October 13.
organisation Ltd.and
The company, operated by BK Japan Holdings Co., Ltd.and owned by Goldman Sachs Alternatives, disclosed the breach on October 15 in a press release, stating that the breach took place between October 2 and 7 while it discovered the leak on October 13.
organisation Goldman Sachs Alternatives
The company, operated by BK Japan Holdings Co., Ltd.and owned by Goldman Sachs Alternatives, disclosed the breach on October 15 in a press release, stating that the breach took place between October 2 and 7 while it discovered the leak on October 13.
‎October 15
Threat actors exploited vulnerabilities in BK Japan Holdings Co., Ltd.'s systems to breach 11.18 million app member records between October 2 and 7, which were later discovered on October 13.
general_metric 7 October
The company, operated by BK Japan Holdings Co., Ltd.and owned by Goldman Sachs Alternatives, disclosed the breach on October 15 in a press release, stating that the breach took place between October 2 and 7 while it discovered the leak on October 13.
source_region Japan
The company, operated by BK Japan Holdings Co., Ltd.and owned by Goldman Sachs Alternatives, disclosed the breach on October 15 in a press release, stating that the breach took place between October 2 and 7 while it discovered the leak on October 13.
organisation BK Japan Holdings Co.
The company, operated by BK Japan Holdings Co., Ltd.and owned by Goldman Sachs Alternatives, disclosed the breach on October 15 in a press release, stating that the breach took place between October 2 and 7 while it discovered the leak on October 13.
organisation Ltd.and
The company, operated by BK Japan Holdings Co., Ltd.and owned by Goldman Sachs Alternatives, disclosed the breach on October 15 in a press release, stating that the breach took place between October 2 and 7 while it discovered the leak on October 13.
organisation Goldman Sachs Alternatives
The company, operated by BK Japan Holdings Co., Ltd.and owned by Goldman Sachs Alternatives, disclosed the breach on October 15 in a press release, stating that the breach took place between October 2 and 7 while it discovered the leak on October 13.
‎2026/10/16
An attacker accessed Burger King Japan's membership system through a third party, exposing 11.18 million app member records containing names, phone numbers, email addresses, and dates of birth.
organisation Burger King Japan Data Breach
Burger King Japan Data Breach Impacts 11.18 Million App Member Records.
data_breach 11.18 App Member Records
Burger King Japan Data Breach Impacts 11.18 Million App Member Records.
BK Japan, the operator of Burger King restaurants in Japan, has confirmed a data breach in which personal information from about 11.18 million official app member records was stolen.
organisation BK Japan
BK Japan, the operator of Burger King restaurants in Japan, has confirmed a data breach in which personal information from about 11.18 million official app member records was stolen.
organisation Burger King
BK Japan, the operator of Burger King restaurants in Japan, has confirmed a data breach in which personal information from about 11.18 million official app member records was stolen.
organisation BK
The exposure occurred after a third party accessed BK Japan’s membership system.
organisation Company Response and Data Exposure
Company Response and Data Exposure BK Japan’s press release (PDF) stated that it does not store credit card numbers in the affected system, and no credit card numbers were exposed.
organisation PDF
Company Response and Data Exposure BK Japan’s press release (PDF) stated that it does not store credit card numbers in the affected system, and no credit card numbers were exposed.
organisation Burger King Japan
Burger King Japan published the original press release in Japanese.
organisation Revolut
Hackread.com reported a similar concern after Revolut disclosed a data breach and phishing messages targeting its customers emerged.
organisation Hackread.com
Hackread.com used AI to create this unofficial English translation for easier understanding.
organisation Seker
That is a plausible follow-on threat, rather than evidence that such a campaign has already occurred,” Seker said.
Tactical Metrics
Metrics
data_breach
11,180,000
App Member Records
Burger King Japan Data Breach Impacts 11.18 Million App Member Records.
BK Japan, the operator of Burger King restaurants in Japan, has confirmed a data breach in which personal information from about 11.18 million official app member records was stolen.
Metrics
data_breach
12,000,000
App Members
The Burger King Japan data breach occurred between October 2 and 7, exposing emails, birth dates and other data from nearly 12 million app members.
Intelligence Sources
HackRead 2026-10-16