2026 Burger King Japan — official app; ~11.18M member records
Data compromised
~11.18 million official-app member records: member ID, email, registration type, prefecture, sex, DOB, name (kanji/kana), phone, whether a mobile-order history exists, whether the email is verified. Company does not hold card numbers. Password leak “not confirmed at present.” PPC notified; members being emailed.
Technical writeup
Verified BK Japan Holdings notice 15 Oct 2026 (Japanese PDF). Access 2–7 Oct; leak confirmed 13 Oct; source blocked. Distinct from the 2024 Burger King Russia / Mindbox incident. companyConfirmed true; recordsAffected 11180000.
Root cause
Unauthorized third-party access to the official-app member system between 2 Oct and 7 Oct 2026; leak established 13 Oct. How the access became possible is still under investigation with outside specialists.