Summary
- Environment: Official app membership system
- Operational impact: Unauthorized access source blocked
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 16, 2026; updated as evidence emerges.
What happened
Impact
Approximately 11.18 million member records were involved. Fields included names, contact details, birth dates, gender, prefecture, member IDs, registration type, and flags for mobile-order history and email verification. [1] The count is records, not established unique people; the order flag does not establish exposure of detailed purchase history.
The company said it did not hold credit-card numbers and had not confirmed password leakage. [1]
Timeline
Access began
Start of the reported unauthorized-access interval.
[1]Access interval ended
The reported interval ended; this is not a recovery date.
[1]Leak confirmed
The investigation confirmed the access and leak.
[1]Notice published
BK Japan issued its customer notice.
[1]Briefing updated
This briefing was last reviewed and updated on October 16, 2026.
Threat Group & Attack Vector
The access method and detailed cause remained under investigation. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
BK Japan blocked the access source, implemented interim measures and reported to Japan’s Personal Information Protection Commission. Investigation, permanent safeguards and customer emails were ongoing. [1]