Burger King Japan has confirmed that attackers accessed a server holding roughly 11.18 million customer records from its official smartphone app, the latest large-scale privacy incident to hit a major quick-service restaurant chain.
The company, operated by BK Japan, said unauthorized access occurred between October 2 and October 7, 2026. Investigators confirmed the leak on October 13 and the company disclosed the incident publicly the following day. The compromised system managed member information for the official app and contained names (in kanji and kana), dates of birth, gender, email addresses, phone numbers, prefecture of residence, member IDs, registration details, and indicators of whether users had used mobile ordering or verified their email.
BK Japan stated that the affected server did not store credit card numbers and that it has not confirmed any leakage of login passwords. The company reported the breach to Japan’s Personal Information Protection Commission and said it blocked the source of the unauthorized access once it was identified. External cybersecurity specialists are assisting with the investigation into how the attackers gained entry. No secondary damage, such as confirmed fraudulent use of the data, has been reported so far. The company has warned customers to be alert for phishing emails, text messages, or calls that impersonate Burger King Japan.
The disclosure comes during a period of elevated cyber activity against Japanese companies. Researchers have tracked more than 100 personal-information incidents in Japan this year, with attackers frequently exploiting access-control weaknesses, configuration errors, and known vulnerabilities in websites and APIs.
Other Recent Privacy Incidents in the Fast-Food Sector
The Burger King Japan breach is not an isolated event in the quick-service restaurant industry. Several other chains and related platforms have disclosed or been linked to significant data exposures in 2025 and 2026.
In late September 2026, researchers found that a customer data platform used by McDonald’s Indonesia exposed more than 40 million records. Roughly 28 million of those were customer records that included names, email addresses, phone numbers, and device IDs. Additional corporate records related to advertising campaigns were also accessible. The database was later secured, but the exposure highlighted risks around loyalty and customer-data platforms that many large chains rely on.
In October 2026, the ransomware group known as The Gentlemen listed KFC on a darknet leak site and threatened to publish allegedly stolen data. KFC has not confirmed a breach, and the group has not released samples of the claimed files. The allegation remains unverified, but it underscores the continued interest of ransomware actors in large restaurant brands.
DoorDash faced a proposed class-action lawsuit after a 2025 incident in which an attacker used social engineering against an employee to access systems. The company said the breach exposed names, phone numbers, email addresses, and physical addresses of customers, merchants, and couriers. DoorDash stated that no payment-card data or Social Security numbers were involved.
Domino’s has notified some customers of account takeovers linked to credential-stuffing attacks. The company has said its own systems were not breached; instead, attackers used email-and-password combinations previously stolen from other sites. Domino’s reported the activity to the UK Information Commissioner’s Office and reset affected accounts.
Earlier in 2026, a threat actor claimed to have leaked data tied to Wendy’s and other brands through a platform used by multiple restaurant operators. The vendor later stated that its systems had not been compromised and that the referenced data was publicly available. Separately, a franchise operator associated with brands including Taco Bell and Pizza Hut disclosed an incident involving employee files.
A 2026 industry report found that a large majority of fast-food chains had experienced some form of cyber incident in the prior year, with many reporting leaks of customer personal information or payment data. The same report noted that most executives expressed confidence in their defenses even after those incidents.
What the Pattern Suggests
Loyalty apps and customer data platforms have become high-value targets because they aggregate names, contact details, order history, and behavioral signals in one place. Even when payment-card numbers are not stored on the breached system—as BK Japan has stated—the remaining personal information can be used for targeted phishing, account takeover attempts on other services, or loyalty-point fraud.
Many of the recent cases involve either third-party platforms, employee social-engineering, or configurations that left large volumes of data reachable. For chains operating across multiple markets, an incident at a single national operator or a shared vendor can still affect millions of customers and create notification and regulatory obligations in multiple jurisdictions.
BK Japan has said it will strengthen security measures and monitoring with help from external specialists. For the broader industry, the volume of recent disclosures suggests that basic controls around app backends, vendor access, and credential hygiene remain uneven even as customer data volumes continue to grow.