Burger King Japan App Breach: 11.18 Million Customer Records Exposed

Six Days of Unauthorized Access to the Official App Server

Burger King Japan is dealing with a major disclosure after attackers accessed a server containing 11.18 million customer records for Burger King Japan’s official app, according to BleepingComputer. The unauthorized access occurred between Friday 2 October and Wednesday 7 October 2026.

According to Pasquale Pillitteri’s report on the incident, BK Japan confirmed the leak on October 13 and made it public on October 15, adding an important distinction about the headline total: the figure counts 11.18 million records, not 11.18 million people.

Security Affairs reports that the company disclosed the incident on October 15 and says the attack vector and attacker are not yet known. Following the discovery, the company confirmed customer membership information from the official app has been leaked externally and set up an incident response team. OODA Loop adds that the company reported the breach to Japan’s Personal Information Protection Commission.

What Was Leaked—and What Was Spared

The compromised membership server held detailed profile and transaction metadata. BleepingComputer reports that exposed data included names, dates of birth, gender, email addresses, phone numbers and order history, while no credit card numbers were stored on the server. Security Affairs further notes that the records include member IDs, names in Japanese characters and kana, prefecture and registration type.

On the authentication side, Pasquale Pillitteri notes that login credential leakage has not been confirmed. In addition, BleepingComputer reports that the company says no secondary damage such as fraudulent use has been confirmed and warned customers about phishing emails, SMS and calls.

What This Means for Retail, Restaurant and Delivery Apps

The Burger King Japan breach has no direct connection to Algeria in the cited reports, yet its business model—a mobile ordering and loyalty app collecting personal profiles alongside order history—mirrors the apps rapidly expanding across Algerian fast food, retail and local delivery services. Three practical lessons apply to both app operators and consumers.

1. Keep payment card storage completely separate from app membership servers

The most important architectural safeguard in the Burger King Japan case was that the compromised server did not store credit card numbers. Algerian restaurant chains and delivery platforms building loyalty apps should delegate card handling entirely to payment processors so an app-server intrusion never exposes financial accounts.

2. Question whether a food-ordering app needs dates of birth and gender

The leaked records contained not only names, phone numbers, email addresses and order history, but also dates of birth, gender and prefecture. For a casual dining or retail loyalty app, collecting demographic fields that are not needed to fulfil an order needlessly increases the value of the database to phishers.

3. Warn users against SMS, call and email lures tied to recent orders

Because the exposed fields combine phone numbers, email addresses and order history, Burger King Japan specifically warned customers about phishing emails, SMS and calls. When an attacker knows what a customer ordered and where they live, social-engineering messages impersonating delivery support or loyalty rewards become far harder to spot.

The Structural Lesson

Retail and fast-food mobile apps often accumulate millions of membership records over time—so much so that a single server in Japan held 11.18 million records—while receiving less security scrutiny than banking or telecom systems. Even when credit card numbers are excluded and login credential leakage is not confirmed, a combined leak of names, phone numbers, email addresses, dates of birth and order history is permanent fuel for targeted fraud.

For Algerian consumer brands digitising customer loyalty, the safest personal data is the data never collected. Minimising registration fields and purging inactive membership records reduces the blast radius before an intrusion ever occurs.

Frequently Asked Questions

Sources & Further Reading

• Burger King Japan data breach exposes 11 million customer records — BleepingComputer
• Burger King Japan disclosed a data breach affecting 11.18M records — Security Affairs
• Burger King Japan data breach exposes personal information of over 11 million app users — OODA Loop
• Burger King Japan confirms data breach: 11 million app records — Pasquale Pillitteri