Whopper of a data breach sees Burger King Japan expose over 11 million customer records

Date:
Mon, 19 Oct 2026 12:05:00 +0000

Description:
The leaked records belonged mostly to Burger King mobile app users.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Burger King Japan discloses breach affecting 11.18 million customer records from its mobile app platform Exposed data included personal details and order histories, though payment information was not compromised Company reported no confirmed misuse and notified regulators while investigating the intrusion The Japanese subsidiary of Burger King has confirmed suffering a data breach and apologized for
losing sensitive data on millions of customers.

In a breach notification letter, Burger King Japan confirmed the exact date
of the breach, as well as the nature of the data that was stolen. "We identified a potential unauthorized third-party access to the system that manages member information for our official app and conducted an investigation," the company said in the letter. "As a result, it was determined on Tuesday, October 13, 2026, that unauthorized access occurred between Friday, October 2, 2026, and Wednesday, October 7, 2026, resulting in a leak of member information. Upon becoming aware of the unauthorized access, we immediately blocked access from the source in question." Latest Videos
From TechRadar Watch full video here: Echoes of Russia The investigation determined that 11.18 million customer records were nabbed, which was mostly data on people using the companys official smartphone app.

It includes peoples names, dates of birth, genders, email addresses, phone numbers, and order histories. While credit card and other payment data was
not exposed, personally identifiable information (PII) is still more than enough to launch convincing phishing emails and escalate to business email compromise (BEC), malware , or even ransomware attacks. You may like Millions of Russian fast food fans hit in Burger King Russia hack Over 8.7 million karaoke fans at risk after major data breach Japanese giant Nippon Columbia says malware infection was to blame for exposing records Millions of stolen records allegedly dumped online by mystery "Hatman" hacker McDonalds, Vodafone and more see Microsoft Azure records stolen

Burger King Japan stressed that there is no evidence of data misuse yet and added that the breach was reported to the countrys Personal Information Protection Commission (PPC).

"We sincerely apologize for the great inconvenience and concern this
situation has caused to our customers and all others involved," it added. "At this time, no secondary damage, such as fraudulent use, resulting from this incident has been confirmed." Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

Burger Kings food isnt the only tasty thing about the company, it seems. Cybercriminals also love breaking in and stealing data. Back in 2024, for example, the Russian arm of Burger King suffered a data breach at the hands
of unknown threat actors and in late September this year, that data leaked online.

In October 2024, Burger King told local media about an attack on Mindbox, a domestic marketing automation platform the company had been using. Through Mindbox, the threat actors managed to obtain sensitive company data,
including information belonging to the customers.

"Among the victims of the attack may also be the data of customers of the Burger King restaurant chain," the company said at the time. Burger King confirms that among the personal data, the accuracy of which is being clarified, there is no information about payment details: open information about transactions is not transmitted or stored by third parties. What to
read next Massive data breach sees 220 million traveler records exposed nine years of airline info leaked including passenger and passport details Chick-fil-A reveals data breach customers warned hackers may have accessed their account info Gyazo breach exposes 23.62 million user records and 490 million image records PII and metadata exposed in huge attack

Just like in the Japan incident, the Russia one did not discuss the details
of the attack, or how it was pulled off. Third-party supply chain attacks are common and often rather disruptive, affecting numerous companies using the same tools. For Mindbox, however, there have been no reports of additional victims. Supply chain attacks In its 2024 results announcement, Mindbox said the attack was its first serious information security incident, which was quickly detected and contained thanks to threat detection tools.

In the aftermath of the breach, Mindbox said it found and eliminated points where employees without access rights to sensitive data could indirectly obtain them, hinting that the attack was, in fact, an identity-based attack rather than a zero-day exploit.

The company also changed development processes to find such points before
they get into the product, and reformed Mindbox's internal role system to
make permissions stricter and more granular. It also limited project access scenarios, introduced a mechanism for confirming access by another employee, and introduced mandatory two-factor authentication, among other things.

Have I Been Pwned?, a website that aggregates information stolen in various hacks and helps people learn if their email addresses and other information had been compromised in the past, has Burger King Russia on its list, but not Burger King Japan.

Via BleepingComputer The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/whopper-of-a-data-breach-sees-burger-ki ng-japan-expose-over-11-million-customer-records


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)