You did not join a burger app to hand over an identity file. Burger King Japan confirmed about 11.18 million member records leaked. I run AliasFleet, an email-alias service: one address per site, so a leak names its source. A food-ordering account is an identity database dressed as coupons. The password surviving does not make the leak harmless.
You wanted the coupon, the faster order, the points adding up quietly. The signup form asked for your name, your birthday, your phone number, your email, and you typed them in without a second thought, because every loyalty signup asks for the same things and none of them feels like a risk decision at the time. Then the breach notice lands, and the list of fields in BK Japan's official notice reads like a dossier assembled one harmless form at a time.
No screenshot of the notice is embedded: the browser capture sandbox cannot render Japanese glyphs legibly.
The signup that built an identity file
Start with the field list, because it is the whole story. The leaked record holds a member ID, an email address, a registration type, a prefecture, a gender, a date of birth, a name in kanji and kana, a phone number, a yes/no flag for whether mobile ordering history exists, and a yes/no flag for whether the email address was verified. BK Japan does not explain what the registration type values mean, so the field sits in the list without interpretation. Everything else is plain enough, and plain is the problem.
The kana name deserves a pause. A scammer working from this file does not just know your name. They know how to say it. A caller who pronounces your name right would not sound like a stranger. The email-verified flag marks which addresses were verified at signup, so an attacker can skip the never-confirmed ones. The mobile-ordering flag marks whose accounts have ordering history, so a message about a Burger King account lands on someone who has ordered. None of these fields looks dangerous on a signup form. Together they describe a person precisely enough to impersonate.
A September press release had put the app past 10 million members. A month later, the file holding those members was gone. Nothing about the signup form changed in between. Only the news did. That is the part loyalty programmes never advertise. The app on your phone looks like coupons. The database behind it is an identity record on millions of people, and it grows by one unthinking signup at a time.
What escaped, and what did not
The disclosure came on 15 October, reported by Oricon, ITmedia, GAME Watch, and Cyber Security News. Here is what BK Japan has settled, and what is still open.
Settled: the company announced the breach itself on 15 October 2026. The unauthorised access ran from 2 to 7 October, and the company confirmed the leak on 13 October. About 11.18 million official-app member records were exposed, and that figure counts records, not a verified count of unique people. The leaked fields are the ones listed above. Credit card numbers were not leaked, because the company does not hold them. A login password leak has not been confirmed so far. After grasping the intrusion, the company blocked access from the source, set up a countermeasures headquarters, and reported to Japan's Personal Information Protection Commission. Individual email notification to affected customers is underway. No confirmed secondary misuse had been reported as of disclosure.
Still open: how the attackers got in. That question is under investigation with an external specialist body, and nobody has named a vector. Whether the 11.18 million records belong to 11.18 million distinct people, or include duplicates and dormant accounts, is unknown. Whether the dataset has surfaced publicly or been traded is unknown. What the registration type values mean is unexplained. Whether the provisional password finding will hold as the investigation continues is unanswered. Whether any other BK Japan systems were touched is unstated.
Two corrections belong here, because they are the details people will get wrong. The mobile-ordering field is a yes/no flag for whether mobile ordering history exists. It is not your order history. Nobody learned what you ate. Prefecture is a region, not your street address. Neither correction makes the leak small. They make it precise, and precision is more useful than panic when the next message arrives.
Why the missing password is not the story
The headline most people will carry away is the reassuring one: no passwords, no credit cards. Treat that as good news about two fields, not as a verdict on the incident. Passwords and card numbers are what an attacker needs for direct account takeover and direct theft. This leak hands over something else, the material for convincing impersonation, and impersonation does not need a password. It needs you to believe the person contacting you.
Picture the message. It arrives on the email address you registered with the Burger King app. It uses your real name, pronounced right, and it refers to your account. It says there is a problem with your membership, or a refund waiting, or a security check after the recent incident. It links to a page that looks like Burger King. Everything about it checks out except the sender, which most people never verify. The attacker does not need your password when they can talk you into handing over the next piece yourself.
BK Japan's own warning says the same thing in formal language. The company warns about mail, SMS, and phone calls impersonating BK Japan or its services, and asks recipients not to open links or attachments, and not to enter member information or passwords, from such messages. When the breached company tells you to expect impersonation, believe it. The notice is describing the most likely next step, and the next step uses the fields that leaked, not the fields that survived.
This dataset has names, phones, and emails. The likeliest abuse is a call, SMS, or email that knows who you are. Anyone who proves who they are by reading your own details back to you is proving they have the file, not that they are Burger King. Do not open links or attachments from such messages, and do not enter member information or passwords in response to them.
There is also the provisional part. "No password leak confirmed so far" is a status update from an open investigation, not a guarantee. The cause is still under investigation with an external specialist body. If that finding changes, the advice changes with it. For now, the correct reading is narrower: assume the identity fields are out, and act on that.
The field you could have made expendable
The email address you registered with the Burger King app is the one field in this leak you could have made expendable. An email alias dedicated to the app, forwarding to your real inbox, changes the impersonation math completely.
Every message on that alias is either from Burger King or from the attacker, and there is no third option. A "security check" quoting your real name, on an address no one but Burger King ever had, that links to a login page has identified itself as the forgery. The real Burger King would never need to email you for data it already holds. Kill the alias and the whole channel dies while your real inbox stays clean. That is the leak-tracing mechanism aimed at exactly this attack. The set-up guide takes about two minutes.
The limit, stated plainly: an alias protects the email field, not the rest of the file. Your name, birthday, and phone number are still out there, and no alias changes that. What the alias does is give you a tripwire. When the phishing wave arrives wearing Burger King's branding, it arrives on an address that names the company it escaped from, and you can cut that channel without touching anything else. That matters because the hardest part of a breach like this is knowing which messages to distrust.
Japan has seen this pattern all autumn. Lawson's breach exposed 2.15 million member records from a convenience-store app. Daiichi Kosho's disclosure put 8.72 million karaoke member records at risk. Now a burger chain adds 11.18 million. Different brands, same shape: a casual signup, an identity-grade file, a breach notice that arrives days after the access. The loyalty programme is the breach vector of the season, and it works because nobody treats the signup like the risk decision it is.
What to do with this breach notice
- Expect the impersonation message, not the account takeover. This dataset has names, phones, and emails. The likeliest abuse is a call, SMS, or email that knows who you are. Anyone who "confirms your identity" by reading your own details back to you is proving they have the file, not that they are Burger King.
- Do not click links in messages about this breach. Open the official app or type the address yourself. This applies to the real notification too. BK Japan is emailing affected customers, and the forgeries will sit right beside the genuine ones.
- Do not enter passwords, payment details, or verification codes in response to unsolicited contact. A real company does not ask for them this way, and a fake one always does.
- If you entered credentials on a suspicious page, change that password now, and change it anywhere else you reused it. Passwords were not listed among the leaked fields, but credential stuffing pairs your leaked email with passwords from other breaches. Read how phishing uses your leaked email to see the sequence.
- Watch for SMS and calls that "confirm your identity" with your own details. Your name, birthday, and phone number are the leaked fields. A caller reading them back is showing you the file, not their credentials.
- Check Have I Been Pwned once the incident is listed, and walk the breach-response order of operations. It is written for exactly this situation.
A burger app holding your name, your birthday, your phone, and your email is not a freak accident. It is what every loyalty signup builds, one coupon at a time, until the file is worth stealing. BK Japan lost 11.18 million of those records in six days, and the next message you get about it might be the breach talking. The signup took seconds. The cleanup takes longer. Give the next one an alias, and the next breach notice becomes a message you can kill in one click instead of a file you have to live with.
Top comments (0)