Full Report
Burger King Japan, the Japanese subsidiary of global fast-food giant Burger King, disclosed a major data breach after attackers accessed a server containing 11.18 million customer records. [...]
Analysis Summary
# Incident Report: Burger King Japan Member Database Breach (October 2026)
## Executive Summary
Burger King Japan, the Japanese subsidiary of Burger King, disclosed that an unauthorized third party accessed a server holding 11.18 million records for its official smartphone app members between October 2 and October 7, 2026. The exposed data included names, dates of birth, gender, email addresses, phone numbers, and order history, and the data was later leaked online. The company says no credit card numbers or user credentials were exposed and no fraud has been confirmed so far. It blocked the access source, reported the incident to Japan's Personal Information Protection Commission (PPC), and is investigating the intrusion with external cybersecurity experts.
## Incident Details
- **Discovery Date:** Not precisely disclosed. The company identified "potential unauthorized third-party access" before concluding its follow-up investigation on October 13, 2026.
- **Incident Date:** Unauthorized access occurred between Friday, October 2, 2026, and Wednesday, October 7, 2026 (per the company's investigation findings).
- **Affected Organization:** Burger King Japan (Japanese subsidiary of Burger King)
- **Sector:** Food service / quick-service restaurant, with a customer-facing mobile app and member database
- **Geography:** Japan (affected customers are app members in Japan; the company operates about 350 locations there)
## Timeline of Events
### Initial Access
- **Date/Time:** Unauthorized access began no earlier than October 2, 2026 (the start of the confirmed access window). The exact start time is not disclosed.
- **Vector:** Not disclosed. The company says it is still investigating how attackers reached the server.
- **Details:** The compromised system was the one that manages member information for the official app. The company has not described the access method, the account or service used, or whether the access was internet-facing.
### Lateral Movement
- Not disclosed. The company has not reported whether attackers moved beyond the member information system.
### Data Exfiltration/Impact
- **Data stolen:** Records for approximately 11.18 million app members, including:
- Names
- Dates of birth
- Gender
- Email addresses
- Phone numbers
- Order history
- **Data not affected (per company):** Credit card numbers and user credentials/passwords.
- **Leak:** The stolen data was leaked online.
- **Fraud:** The company stated that "no secondary damage, such as fraudulent use," has been confirmed.
### Detection & Response
- **Detection:** The company identified potential unauthorized access, and a follow-up investigation was concluded on October 13, 2026, confirming the access window and data leak. The detection method was not disclosed.
- **Response actions:**
- Blocked access from the source in question once aware of the activity
- Reported the breach to Japan's PPC
- Engaged external cybersecurity experts to investigate the attack path
- Published a public notice (press release dated October 15, 2026) with an apology
- Warned customers about phishing via email, SMS, and phone calls impersonating Burger King Japan, and advised them not to click links, open attachments, or enter member information or passwords on unsolicited requests
## Attack Methodology
*The company has not disclosed technical details. The entries below are unconfirmed for this incident.*
- **Initial Access:** Undisclosed
- **Persistence:** Undisclosed
- **Privilege Escalation:** Undisclosed
- **Defense Evasion:** Undisclosed
- **Credential Access:** The company states no user credentials were found to be accessed. How the attackers obtained data is undisclosed.
- **Discovery:** Undisclosed
- **Lateral Movement:** Undisclosed
- **Collection:** The attackers accessed the member information database and obtained customer records.
- **Exfiltration:** Data was taken from the server and later published online. The exfiltration method is undisclosed.
- **Impact:** Personal data exposure and public leak. No ransomware or service disruption has been reported.
**Context:** The article cites Macnica researcher Yutaka Sejiyama, who has logged 119 cybersecurity incidents involving personal information theft or exposure in Japan in 2026. He reports attackers are probing websites and APIs for access-control, configuration, and authentication weaknesses and exploiting known (n-day) vulnerabilities. This is industry trend data, not a confirmed finding for this incident.
## Impact Assessment
- **Financial:** Not disclosed. No cost estimates have been published.
- **Data Breach:** Personal and transactional data for about 11.18 million app members (names, birth dates, gender, emails, phone numbers, order history). Payment card data and credentials are reported as not affected.
- **Operational:** No operational disruption has been reported. The article does not mention service outages.
- **Reputational:** Significant. The breach is part of a broader wave of 2026 incidents affecting major Japanese companies, and the company issued a public apology. The article lists several peers affected this year, including Nikkei, KDDI, Sakura Internet, Keio, Nihon Kotsu, Times Car, IDC Frontier, and Daiichi Kosho.
## Indicators of Compromise
*No technical IOCs (IPs, domains, file hashes) were published in the article.*
- **Network indicators:** None disclosed. The company blocked "the source in question," but its identifiers were not published.
- **File indicators:** None disclosed.
- **Behavioral indicators:**
- Unexpected access to the app member information system between October 2 and October 7, 2026
- Customer reports of phishing via email, SMS, or phone impersonating Burger King Japan
- Bulk data appearing on online leak sites
## Response Actions
- **Containment:**
- Blocked access from the identified source
- Notified the PPC and affected customers
- **Eradication:**
- Not publicly described. The company is investigating the intrusion path with external experts, so eradication details are likely pending.
- **Recovery:**
- Public apology and customer advisories issued
- Ongoing investigation into how the attackers gained access
- No restoration or service-recovery details reported
## Lessons Learned
- **Key takeaways:**
- Member databases holding personal and order data are high-value targets, and their exposure creates phishing risk for customers long after the breach.
- The confirmed access window (about five days) suggests the activity may have gone unnoticed for some time before detection.
- Quick source blocking and external expert involvement are sound steps, but they do not show how the breach occurred or prevent a repeat.
- **What could have been done better (inferred from public information):**
- Earlier detection of bulk data access or exfiltration from the member database, since the leak happened during or shortly after the access window
- Stronger monitoring of internet-facing systems and APIs holding customer data, given industry reports of attackers targeting access-control and authentication weaknesses
- Faster customer notification to limit phishing exposure. The company's public notice came about eight days after the access window closed.
## Recommendations
- **Access control and authentication:** Enforce least-privilege access to member databases. Require MFA for administrative and service accounts. Audit API authorization on every endpoint that returns customer records.
- **Vulnerability management:** Patch known (n-day) vulnerabilities quickly, especially on internet-facing servers and APIs. Continuously scan for misconfigurations.
- **Data minimization and protection:** Limit stored personal data to what is necessary. Encrypt sensitive fields at rest, and consider tokenizing or pseudonymizing data such as contact details and order history.
- **Detection and monitoring:** Alert on abnormal query volumes, bulk exports, and access from unusual sources against customer databases. Retain logs to support forensic investigation.
- **Incident preparedness:** Maintain a tested incident response plan with defined timelines for internal escalation, regulatory reporting (such as PPC requirements in Japan), and customer notification.
- **Customer protection:** Provide clear phishing guidance and, where appropriate, proactive monitoring or advisories for affected users. Make sure official communication channels are easy to verify.
- **Third-party assurance:** Require security assessments of app and cloud vendors that host or process member data, and confirm that their systems meet the same controls.