Burger King Japan disclosed that attackers accessed a server holding 11.18 million customer records, after concluding a follow-up investigation on 13 October 2026. The company said unauthorised access occurred between 2 and 7 October and that the data, drawn from users of its official smartphone app, included names, dates of birth, gender, email addresses, phone numbers and order history; the information has since been leaked online. The Japanese subsidiary of the global fast-food chain, which operates around 350 restaurants in Japan, apologised in a press release and said it identified the potential third-party access to its member-information system and investigated. This is one of the largest consumer-record exposures of the month and follows a familiar shape — a loyalty and mobile-app member database as the single high-value target. It underlines app-data concentration risk for consumer brands, and for Australian franchisees of global chains it is a reminder that regional app data often sits in systems outside head-office visibility.

• Source article