**Burger King Japan**, a subsidiary of the global fast-food chain, has announced a substantial data breach affecting approximately 11.18 million customer records. The company confirmed that unauthorized access to its official smartphone app's member information system occurred between October 2 and October 7, 2026. ### Details of the Compromise The compromised server stored a range of personal data, including customer names, dates of birth, gender, email addresses, phone numbers, and order history. However, **Burger King Japan** stated that credit card numbers were not stored on the breached server, and no evidence suggests that user credentials were accessed by the threat actors. In a press release, the company confirmed the conclusion of its follow-up investigation on October 13, 2026, and issued an apology to affected customers. "We identified a potential unauthorized third-party access to the system that manages member information for our official app and conducted an investigation," **Burger King Japan** stated. "Upon becoming aware of the unauthorized access, we immediately blocked access from the source in question." ### Response and Ongoing Investigation **Burger King Japan** has reported the incident to Japan's **Personal Information Protection Commission (PPC)** and is actively investigating the methods used by the attackers to gain access. This investigation is being conducted with the assistance of external cybersecurity experts. While no secondary damage, such as fraudulent use of the stolen data, has been confirmed at this time, the fast-food chain has issued a warning to affected customers. They are advised to remain vigilant against suspicious emails, SMS messages, and phone calls that may impersonate **Burger King Japan**, and to exercise caution when clicking URLs, opening attachments, or entering personal information. ### Broader Trend in Japan This incident adds to a growing list of cyberattacks targeting major Japanese companies throughout 2026. Notable breaches this year have impacted entities such as entertainment system maker **Daiichi Kosho**, cloud and digital infrastructure firm **IDC Frontier**, publishing giant **Nikkei**, railway operator **Keio**, car-sharing service **Times Car**, and telecommunications giant **KDDI**, among others. **Macnica** researcher **Yutaka Sejiyama** has documented 119 cybersecurity incidents involving personal information theft or exposure in Japan this year. His research indicates a trend where attackers are increasingly targeting websites and APIs, exploiting weaknesses in access control, configuration, authentication, and known (n-day) vulnerabilities.