Burger King’s Japanese operator has disclosed a data breach that exposed approximately 11.18 million records belonging to members of its official mobile app.
BK Japan announced the incident on October 15, saying an investigation established that unauthorized access occurred between October 2 and October 7. The company confirmed on October 13 that member information had leaked from the system managing app membership data.
The operator said it blocked access from the source of the unauthorized connections immediately after learning of the intrusion. External specialists are helping investigate how the attackers gained access, with the entry method and underlying cause still undetermined.
Personal and account information exposed
According to the announcement, the leaked records contained:
- Member IDs
- Email addresses
- Registration types
- Prefectures
- Gender
- Dates of birth
- Names written in kanji and kana
- Telephone numbers
The exposed information also included indicators showing whether members had a mobile ordering history and whether their email addresses had been verified. The notice identifies the presence or absence of an ordering history among the leaked fields, without listing individual purchases or transaction details.
BK Japan said credit card numbers were not exposed because it does not retain them. It also said it had not confirmed any leakage of login password information, leaving that aspect subject to the ongoing investigation.
The company described the scale as approximately 11.18 million member records, without separately specifying a count of unique individuals. As of the announcement, it had not confirmed fraudulent use or other secondary harm resulting from the breach.
Notifications and security measures
BK Japan has established an incident response headquarters, implemented temporary countermeasures, and reported the breach to Japan’s Personal Information Protection Commission.
The operator is also implementing permanent countermeasures, continuing its investigation with external specialists, and notifying affected customers by email. It said it would strengthen system security and monitoring to prevent a recurrence.
The combination of contact information and personal details could help scammers create convincing messages impersonating Burger King or its support staff.
Customers should be cautious about unexpected emails, text messages, or calls claiming to come from Burger King, particularly communications requesting account information or passwords. The company advises recipients of suspicious messages to avoid opening attachments, following links, or entering their credentials.
Anyone uncertain about a notification should contact Burger King through independently verified support details rather than responding directly to the message.
Leave a Reply