October 15, 2026: Burger King Japan disclosed a security breach affecting the company's mobile app user database. 11.18 million app member records were exposed, including customer names, email addresses, phone numbers, and transaction history. The breach was discovered during a routine security audit. Burger King Japan is offering affected customers complimentary fraud monitoring and credit protection services. Canonical: burger-king-japan-app-breach2026. Source: BleepingComputer.
What happened
On October 15, 2026, Burger King Japan disclosed a data breach affecting its mobile app database. The breach occurred between August and October 2026 when attackers gained unauthorized access to customer records through an unpatched database vulnerability. Approximately 11.18 million app member records were exposed during this period. The company discovered the unauthorized access during a routine security audit and immediately secured the systems. Affected customers received notification emails on October 15-16.
Technical analysis
Attack vector: Unpatched database vulnerability in Burger King Japan's mobile app backend infrastructure. Attackers exploited a known SQL injection flaw that allowed direct database access without authentication.
Data exposed: Customer names, email addresses, phone numbers, transaction history, app login credentials, preferred dining locations and order history.
Scope: 11.18 million records; approximately 8% of Japan's population. The breach affected all Burger King Japan app users with active accounts created between 2015-2026.
Detection timeline: Unauthorized access began August 2026. Breach discovered October 15 during internal security audit. No indication that attackers maintained access or deployed malware.
Impact
Customer risks: Identity theft (full names and contact information exposed), account takeover (app login credentials compromised), phishing and social engineering (attackers know customer's restaurant preferences and order history), and location tracking (preferred restaurant locations exposed).
Business impact: Reputational damage to Burger King brand in Japan. Regulatory scrutiny from Japanese Personal Information Protection Commission (APPC). Legal liability for notification costs, credit monitoring services, and potential class-action lawsuits.
Industry context: This is Japan's third-largest restaurant/hospitality breach on record and highlights ongoing vulnerabilities in mobile app security across the quick-service restaurant industry.
Why mobile apps are targeted
Mobile app backends are frequently targeted because they often lack the security investment of primary web platforms. SQL injection vulnerabilities, while well-understood, continue to plague backend services that don't use parameterized queries or modern ORM frameworks. The ease of identifying and exploiting database vulnerabilities makes mobile app backends attractive targets for attackers seeking large user databases.
The fact that this breach went undetected for 2-3 months (August-October) suggests Burger King Japan lacked comprehensive logging, anomaly detection, or intrusion detection systems capable of identifying bulk data extraction.
What to do
- Change your Burger King Japan app password immediately. Use a strong, unique password not shared with other services.
- Monitor for phishing emails. Burger King Japan may contact you; verify through official channels (official website, calling restaurant directly).
- Check your app account activity. Review order history and account settings for unauthorized changes.
- Monitor credit reports. Watch for fraudulent accounts or identity theft using your name and address.
- Enable two-factor authentication if available. This prevents account takeover even with compromised passwords.
- Accept offered credit monitoring services. Burger King Japan is providing complimentary fraud monitoring; enroll if eligible.
Related reading
See restaurant industry security best practices and mobile app security standards.