Huge data breach causes Burger King Japan to expose over 11 million customer records
- Burger King Japan reveals breach affecting 11.18 million customer records from its mobile app platform
- The exposed data included personal data and order histories, although payment information was not compromised.
- The company did not report any confirmed misuse and notified regulators while investigating the intrusion.
The Japanese subsidiary of Burger King confirmed it had suffered a data breach and apologized for the loss of confidential data of millions of customers.
In a breach notification letter, Burger King Japan confirmed the exact date of the breach, as well as the nature of the stolen data.
“We identified possible unauthorized third-party access to the system that manages member information for our official app and conducted an investigation,” the company said in the letter. “As a result, it was determined on Tuesday, October 13, 2026 that the unauthorized access occurred between Friday, October 2, 2026 and Wednesday, October 7, 2026, resulting in a breach of member information. Upon becoming aware of the unauthorized access, we immediately blocked access from the source in question.”
Latest videos ofTechnologyRadar
Echoes of Russia
The investigation determined that 11.18 million customer records were captured, mostly data from people using the company’s official smartphone app.
Includes people’s names, dates of birth, genders, email addresses, phone numbers, and order histories. While credit card and other payment data was not exposed, personally identifiable information (PII) is still more than enough to launch convincing phishing emails and escalate to business email (BEC) attacks, malware, or even ransomware.
Burger King Japan emphasized that there is still no evidence of data misuse, adding that the breach was reported to the country’s Personal Information Protection Commission (PPC).
“We sincerely apologize for the significant inconvenience and concern this situation has caused our customers and everyone else involved,” he added. “At this time, no secondary harm, such as fraudulent use, has been confirmed resulting from this incident.”
Apparently, Burger King’s food isn’t the only tasty thing about the company. Cybercriminals also love to break in and steal data. In 2024, for example, Burger King’s Russian subsidiary suffered a data breach at the hands of unknown threat actors, and in late September of this year, that data was leaked online.
In October 2024, Burger King told local media about an attack on Mindbox, a national marketing automation platform the company had been using. Through Mindbox, threat actors managed to obtain sensitive company data, including information belonging to customers.
“Among the victims of the attack may also be the data of customers of the Burger King restaurant chain,” the company stated then. “Burger King confirms that among the personal data, the accuracy of which is being clarified, there is no information on payment details: open information about transactions is not transmitted or stored by third parties.”
As with the Japan incident, the Russia incident did not discuss the details of the attack or how it was carried out. Third-party attacks on the supply chain are common and often quite disruptive, affecting numerous companies using the same tools. In the case of Mindbox, however, there have been no reports of additional victims.
Supply chain attacks
In its 2024 results announcement, Mindbox said the attack was its “first serious information security incident,” which was quickly detected and contained “thanks to threat detection tools.”
Following the breach, Mindbox said it “found and eliminated points where employees without access rights to sensitive data could indirectly obtain it,” hinting that the attack was, in fact, an identity-based attack rather than a zero-day exploit.
The company also “changed development processes to find those points before they go into the product” and overhauled Mindbox’s internal role system to make permissions more strict and granular. It also limited project access scenarios, introduced a mechanism to confirm another employee’s access, and introduced mandatory two-factor authentication, among other things.
Have I Been Pwned?, a website that aggregates information stolen in various hacks and helps people know if their email addresses and other information have been compromised in the past, has Burger King Russia on its list, but not Burger King Japan.
Through beepcomputer
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment