The email arrives on a Thursday morning. The subject line is an apology from Burger King about your app account, and it has your name, your birth date and your phone number in it. The message asks you to sign in and confirm your details. It might be the real notice, because BK Japan has said it will email the people caught in the Burger King Japan data breach. Or the people who took the data wrote it, since they hold the same details and can put them in the same places.
Confirmation: confirmed by the company, in a published notice dated 15 October 2026.
What happened in the Burger King Japan data breach
BK Japan Co., Ltd. runs Burger King’s roughly 310 Japanese restaurants and the Japanese official app. On 15 October it published a notice saying a third party reached the system that manages app member information, and that member data left the company.
The notice gives dates rather than estimates. Unauthorized access ran from Friday 2 October to Wednesday 7 October. Then, on Tuesday 13 October, the company established that member information had leaked, and it says it cut off traffic from that source as soon as it knew. It has reported the incident to Japan’s Personal Information Protection Commission and set up an internal response unit.
How the attacker got in is still unknown. The notice says the route and the detailed cause remain under investigation with outside specialists, so nobody can yet name the door that was open — including the company.
What the Burger King Japan data breach exposed, and what each item is worth
The notice lists ten data items across about 11.18 million app member records.
- Member ID and email address. The address is the delivery route for everything below.
- Name, in both kanji and kana. Two spellings make a fake message read as a system that already knows you.
- Date of birth, gender and prefecture.
- Phone number. So the follow-up does not have to arrive by email at all.
- Registration type.
- Whether the member has mobile-order history.
- Whether the email address had been verified.
Those last two are narrower than they look, and the final one is the most useful item in the set to an attacker. A verification flag marks the addresses that a real person reads. So a list of 11.18 million becomes a shorter list of confirmed, live inboxes, sorted for whoever bought it.
The notice records mobile-order history as a yes or a no, and it is explicit about that: the field covers whether orders exist, not what anyone ordered. Some early coverage described it as order history, which reads as a purchase log and overstates the exposure.
The data left out two things, and the wording matters for each. The company does not hold credit card numbers at all, so none of them left. On passwords the notice says that leakage of login password information has not been confirmed — which describes what the investigation has found so far, and the investigation is still open. Read it as unresolved rather than as an all-clear.
The company will notify by email, and that is the hard part
BK Japan’s notice says two things a few lines apart. The company will contact affected customers by email. It also asks those customers to be wary of suspicious emails, text messages and phone calls impersonating the company, and to avoid following links, opening attachments, or entering member details or passwords.
Both instructions are right, and together they describe an impossible morning. Millions of people have been told to expect an important email from Burger King and to distrust email from Burger King, in the same document. Meanwhile the attacker holds the name, the birth date, the phone number and the flag confirming the address is live. So the fake version can be more specific than ordinary phishing mail ever manages to be.
This is the shape every breach takes a week later. The data itself is rarely what harms someone. The message built from it is.
Is your Burger King app account in this if you are not in Japan?
The notice comes from BK Japan, which holds the master franchise for Japan and runs the Japanese app. Burger King operates country by country under Restaurant Brands International, so the member system described here is the Japanese one.
Nothing in the notice refers to accounts in other countries, and no reporting so far places them in the data. There is also no statement saying US accounts are clear, because no company has published one. In short: if your Burger King account is American, this notice is not about it, but an unexpected Burger King email deserves the same care this week either way.
What to do now
Most of what follows has nothing to do with us.
- Treat any Burger King message as a notification, not an instruction. Read it, then open the app or type the company’s address yourself to check anything it claims.
- Expect a text message and a phone call too, because this set included phone numbers.
- Watch for the birthday lure. The attacker holds dates of birth, so “your birthday reward is waiting, confirm your details” is the obvious build.
- Change the password on that app account, and use a password manager so the same password does not exist on a dozen other sites.
- Turn on the strongest sign-in each of your accounts offers, which usually means a passkey or an authenticator app ahead of SMS codes.
- Check the sender’s full address, not the display name. A convincing fake uses the right name and a domain that is close but wrong.
How OptMsg changes this exposure
We want to be careful here, because this breach happened at another company and nothing on our side would have changed what left their servers.
What changes is the next step, on your side. Mail from a sender you have not approved goes to Trash rather than your Inbox, and auto-deletes after 30 days. So the fake Burger King notice built from this data arrives in Trash instead of sitting beside the real one, and you decide which senders reach you rather than judging each message as it lands.
Your OptMsg account also has no password, so a password stolen from another site can’t open your inbox. Because your email is how most accounts get reset, keeping that door shut keeps the rest shut with it.
Here is what the argument does not cover, stated plainly. It does nothing about a compromised device, a live phishing page you type your details into, or somebody holding your unlocked phone. The claim is narrow on purpose, and it is still worth having: a password that does not exist cannot be stolen or stuffed. Our simple by design page explains how the approved-sender part works.
Want an inbox where a breach at somebody else’s company does not become your Thursday morning? Create your OptMsg account and pick your address while the good ones are free to choose.
Create Your Account
Your Inbox. Your Rules.
Frequently asked questions
Q: Was my password exposed in the Burger King Japan data breach? A: The company says leakage of login password information has not been confirmed, and its investigation continues. That wording is narrower than a clean denial, so change the password on that account and do not reuse it elsewhere.
Q: Were credit card details taken? A: No. BK Japan says it does not hold credit card numbers, so the data contained none.
Q: I have the Burger King app in the US. Am I affected? A: This notice covers the Japanese app’s member system, run by BK Japan under its master franchise. No reporting places accounts in other countries in the data. No company has published a US-specific all-clear either, so treat an unexpected Burger King email carefully this week.
Q: How will I know the real notification email from a fake one? A: From the inbox alone, you often cannot, which is the problem. Read any such message as a prompt to go and check, then reach Burger King by opening the app or typing the address yourself.
Q: What does the “email address verified” flag actually give an attacker? A: Confirmation that a human reads that address. It turns a list of 11.18 million into a shorter, more valuable list of live inboxes, which is why the next message is the thing to watch for.
Sources
- BK Japan Co., Ltd., “不正アクセスによる公式アプリ会員情報漏えいに関するお詫びとお知らせ”, 15 October 2026 — https://www.burgerking.co.jp/images/notice/2026/10/15/d4d114ca-ebd7-4f3d-94ef-c4ea7a84a139.pdf
- BleepingComputer, “Burger King Japan data breach exposes 11 million customer records”, 16 October 2026 — https://www.bleepingcomputer.com/news/security/burger-king-japan-data-breach-exposes-11-million-customer-records/
- CyberInsider, “Burger King Japan data breach”, 16 October 2026 — https://cyberinsider.com/burger-king-japan-data-breach/
Previous in Breach Breakdown: You Never Signed Up For Crunchbase. It Had Your Phone Number Anyway.
