--- title: "Burger King Japan app-member data incident" description: "Burger King Japan disclosed leakage of approximately 11.18 million official app-member records." incident_type: "Data incident" status: "active" last_modified: "2026-10-16" canonical_url: "https://www.ally.security/incidents/burger-king-japan-app-member-data-incident-2026" markdown_url: "https://www.ally.security/incidents/burger-king-japan-app-member-data-incident-2026.md" stix_url: "https://www.ally.security/incidents/burger-king-japan-app-member-data-incident-2026/stix.json" --- # Burger King Japan app-member data incident BK Japan confirmed unauthorized access to its app membership system. Last modified Oct 16, 2026 · 1 source ## Summary - **Environment:** Official app membership system - **Operational impact:** Unauthorized access source blocked - **Financial impact:** No incident cost established in the reviewed evidence ## What happened [BK Japan](https://www.burgerking.co.jp/) confirmed that unauthorized access to its official app membership system leaked member information. [1](#source-1) ## Impact Approximately 11.18 million member records were involved. Fields included names, contact details, birth dates, gender, prefecture, member IDs, registration type, and flags for mobile-order history and email verification. [1](#source-1) The count is records, not established unique people; the order flag does not establish exposure of detailed purchase history. The company said it did not hold credit-card numbers and had not confirmed password leakage. [1](#source-1) ## Timeline ### October 2, 2026 — Access began Start of the reported unauthorized-access interval. [1](#source-1) ### October 7, 2026 — Access interval ended The reported interval ended; this is not a recovery date. [1](#source-1) ### October 13, 2026 — Leak confirmed The investigation confirmed the access and leak. [1](#source-1) ### October 15, 2026 — Notice published BK Japan issued its [customer notice](https://www.burgerking.co.jp/images/notice/2026/10/15/d4d114ca-ebd7-4f3d-94ef-c4ea7a84a139.pdf). [1](#source-1) ### October 16, 2026 — Briefing updated This briefing was last reviewed and updated on October 16, 2026. ## Threat Group & Attack Vector The access method and detailed cause remained under investigation. [1](#source-1) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response BK Japan blocked the access source, implemented interim measures and reported to Japan’s [Personal Information Protection Commission](https://www.ppc.go.jp/). Investigation, permanent safeguards and customer emails were ongoing. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### 不正アクセスによる公式アプリ会員情報漏えいに関するお詫びとお知らせ official · BK Japan Co., Ltd. · Oct 15, 2026
Evidence ledger Review the supporting structured claims. 1. **Exposed Data Category · 100% confidence · current** Official app-member information (approximate record count): Usernames and account identifiers 2. **Occurred At · 100% confidence · current** Customer notice issued: 2026-10-15 3. **Resulted In · 100% confidence · current** Burger King Japan app-member data breach: The disclosed fields include member ID, email address, registration type, prefecture, gender, birth date, name, telephone number, whether mobile-order history exists and whether the email address is verified. 4. **Occurred At · 100% confidence · current** Reported access interval ended: 2026-10-07 5. **Resulted In · 100% confidence · current** Burger King Japan app-member data breach: The detailed cause and method enabling unauthorized access were still under investigation with outside specialists. 6. **Resulted In · 100% confidence · current** Burger King Japan app-member data breach: Reported access interval ended 7. **Occurred At · 100% confidence · current** Unauthorized access began: 2026-10-02 8. **Resulted In · 100% confidence · current** Burger King Japan app-member data breach: Leak confirmed 9. **Exposed Data Category · 100% confidence · current** Official app-member information (approximate record count): Contact information 10. **Resulted In · 100% confidence · current** Burger King Japan app-member data breach: The company said it did not retain credit-card numbers and those numbers had not leaked; it had not confirmed leakage of login passwords at disclosure. 11. **Resulted In · 100% confidence · current** Reported access interval ended: End of the documented access interval; not a restoration date. 12. **Exposed Data Category · 100% confidence · current** Official app-member information (approximate record count): Geographic location information 13. **Occurred At · 100% confidence · current** Leak confirmed: 2026-10-13 14. **Affected Organization · 100% confidence · current** Burger King Japan app-member data breach: BK Japan Co., Ltd. 15. **Disclosed At · 100% confidence · current** Burger King Japan app-member data breach: 2026-10-15 16. **Began At · 100% confidence · current** Burger King Japan app-member data breach: 2026-10-02 17. **Resulted In · 100% confidence · current** Burger King Japan app-member data breach: Customer notice issued 18. **Exposed Record Count · 100% confidence · current** Official app-member information (approximate record count): 11,180,000 record 19. **Resulted In · 100% confidence · current** Burger King Japan app-member data breach: Further investigation, permanent safeguards and customer email notifications were ongoing at disclosure. 20. **Resulted In · 100% confidence · current** Burger King Japan app-member data breach: On October 13, the investigation established the October 2–7 unauthorized access and member-information leak. 21. **Exposed Data Category · 100% confidence · current** Official app-member information (approximate record count): Dates of birth 22. **Exposed Data Category · 100% confidence · current** Official app-member information (approximate record count): Gender information 23. **Resulted In · 100% confidence · current** Burger King Japan app-member data breach: BK Japan confirmed that outside access to its official app membership system had leaked member information. 24. **Exposed Data Category · 100% confidence · current** Official app-member information (approximate record count): Names 25. **Ended At · 100% confidence · current** Burger King Japan app-member data breach: 2026-10-07 26. **Resulted In · 100% confidence · current** Customer notice issued: BK Japan published the member-information notice. 27. **Resulted In · 100% confidence · current** Burger King Japan app-member data breach: The company blocked the access source, applied interim measures, established a response team and reported to Japan’s Personal Information Protection Commission. 28. **Resulted In · 100% confidence · current** Burger King Japan app-member data breach: Official app-member information (approximate record count) 29. **Resulted In · 100% confidence · current** Leak confirmed: The investigation established unauthorized access and leakage. 30. **Resulted In · 100% confidence · current** Burger King Japan app-member data breach: Unauthorized access began 31. **Resulted In · 100% confidence · current** Unauthorized access began: Start of the reported access interval.