If you have a Burger King Japan app account, assume your name, date of birth, phone number and email address were exposed in the October 2026 breach of about 11.18 million member records. Card numbers were not stored, so your priority is spotting phishing, changing your app password, and limiting where your phone and email circulate.
What Happened in the Burger King Japan Breach
BK Japan, the company that operates Burger King restaurants in Japan, says an unauthorized third party accessed the member information system behind its official smartphone app between October 2 and October 7, 2026. The company confirmed the leak on October 13, announced it on October 15, and reported it to Japan's Personal Information Protection Commission.
The affected dataset covers roughly 11.18 million member records. BK Japan has not said how many unique people that represents — some members may have more than one record — but it is one of the largest consumer app breaches of 2026. The company says it blocked the source of the unauthorized connections, set up an incident response team, and is working with outside specialists who are still investigating how the attacker got in.
What Data Was Exposed
According to the company's disclosure, the exposed fields include:
- Full names (in both kanji and kana)
- Email addresses and whether the email was verified
- Phone numbers
- Dates of birth and gender
- Prefecture of residence
- Member IDs, registration type, and whether the member had used mobile ordering
What was not exposed
Credit card numbers were not leaked because BK Japan says it does not retain them. The company has not confirmed whether login passwords were accessed — that part of the investigation is ongoing — so treat your password as potentially compromised until told otherwise.
Name, birth date, phone and email together is exactly the bundle scammers want. It lets them write convincing messages that use your real details, and it is the same data people-search sites and data brokers trade every day.
What to Do Right Now
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
Step 1: Change your Burger King app password
Open the app (or the BK Japan member site) and set a new, unique password. If you reused that password anywhere else — email, shopping, banking — change it there first, because those accounts are worth far more to an attacker.
Step 2: Treat every "Burger King" message as suspicious
BK Japan plans to notify affected members by email, which gives scammers a perfect cover story. Expect fake breach notices, "refund" or "compensation" offers, and free-coupon texts that link to look-alike login pages. Do not click links or open attachments in unexpected messages; go to the app or official website directly instead. Our guide to spotting smishing text scams covers the red flags.
Step 3: Lock down your phone number
A leaked phone number tied to your name and birth date raises the risk of scam calls and SIM-swap attempts. Add a carrier account PIN or port-out lock, and switch your important accounts from SMS codes to an authenticator app where possible. See what to do if your phone number is leaked for the full checklist.
Step 4: Turn on two-factor authentication on your email
Your email address is the key to password resets for almost every other account. Make sure it has a strong unique password and two-factor authentication turned on, and review its recovery phone and backup email for anything you don't recognise.
Step 5: Watch for your data resurfacing
Large breach datasets tend to end up on criminal forums and in combined "combo lists" months later. Run a check to see if your information is on the dark web, and keep an eye on accounts that use the same email address.
Ignore anyone charging to "remove" you from the leak
Once data is stolen it cannot be recalled from criminal hands. Any service promising to delete your record from the Burger King breach itself is a scam. What you can control is how much additional data about you is freely available — which is what makes leaked records useful to fraudsters.
Why Breach Data Gets More Dangerous Over Time
On its own, a fast-food app record is a moderate risk — though, as with most loyalty program data, it reveals more than it seems. The danger comes from combination. Criminals merge breach dumps with data broker and people-search profiles that add your home address, relatives, past addresses and more phone numbers. A name, birth date and phone number from one breach plus an address from a broker is enough to attempt account takeovers, impersonation and highly targeted phishing.
That is why reducing your broker footprint matters after any breach. PrivacyOn removes your personal information from 100+ data brokers and people-search sites, monitors 24/7 and re-files automatically when you are relisted, and includes dark web monitoring that alerts you when your email or phone number shows up in new leaks — with family plans covering up to 5 people from $8.33/month. If you are comparing options, see our ranking of the best data removal services.
See what is already exposed
Start with a free PrivacyOn scan to find which sites are publishing your name, phone number and address right now, and close the gaps scammers use to make breach data dangerous.
Frequently Asked Questions
Was my credit card exposed in the Burger King Japan data breach?
No. BK Japan says it does not store credit card numbers, so card data was not part of the leak. You do not need to cancel a card because of this breach, but you should still watch statements for phishing-driven fraud.
How many people were affected by the Burger King Japan breach?
The company reported about 11.18 million app member records. It has not said how many unique individuals that covers, since some people may hold more than one record.
Were passwords leaked in the Burger King breach?
BK Japan has not confirmed any password leak, but the investigation into how attackers got in is still ongoing. Change your app password now and anywhere you reused it.
Does this affect Burger King customers in the US?
The breach involves the app run by BK Japan, the Japanese franchise operator, not Burger King's US app. If you only used Burger King in the United States, you are not part of this incident — but anyone who registered with the Japanese app, including visitors and residents, should follow the steps above.
Will Burger King Japan notify me?
The company says it plans to contact affected members by email. Because scammers will imitate those notices, verify any message through the official app or website rather than clicking its links.
How can I protect myself after this breach?
Change reused passwords, turn on two-factor authentication, lock your phone account against SIM swaps, and reduce how much of your data is publicly available. PrivacyOn automates that last step by removing you from 100+ data brokers with continuous monitoring and dark web alerts — run the free scan to see where you are exposed.