Burger King Japan has confirmed a significant data breach affecting approximately 11.18 million records of its app users. An unauthorized party accessed the system managing app member information between October 2 and October 7, with the breach being confirmed on October 13, 2026. This incident involves member IDs, email addresses, registration types, regions, genders, birth dates, full names, and phone numbers. However, credit card numbers and login passwords were not part of the leaked data, according to BK Japan's current findings. The company has taken immediate steps to block further unauthorized access and has formed a response team, while also notifying Japan's Personal Information Protection Commission and emailing affected users. Outside experts are aiding in the investigation to determine the vulnerability exploited by the attacker. Although no secondary harm or fraudulent use of the exposed data has been confirmed, the combination of personal details presents a potential risk for phishing scams. BK Japan advises its members to exercise caution with unexpected communications and to verify messages through official channels. The investigation is ongoing, and further updates are expected to clarify the method of access and security failures involved.