Burger King Japan app breach exposes about 11.18 million membership records
In short
Burger King's Japanese operator said on October 15 that unauthorized access exposed about 11.18 million official-app membership records. The leaked information includes names, email addresses and phone numbers; the company said it had not confirmed any resulting misuse.
Read the full story 1 min read
Burger King's Japanese operator announced on October 15 that unauthorized access to the system managing its official app's membership information had exposed about 11.18 million records. The company said the information included members' names, email addresses and telephone numbers. It apologized to customers and others affected, while saying it had not confirmed secondary harm such as unauthorized use resulting from the incident. [ 3 , 4 , 5 , 11 ]
Technology outlets listed the exposed fields as member IDs, email addresses, registration type, prefecture, gender, dates of birth, names in kanji and kana, and telephone numbers. The data also indicated whether a member had a mobile-order history and whether an email address had been verified. The operator said it did not hold credit-card numbers, so those had not leaked. It also said it had not confirmed any exposure of login passwords. [ 4 , 5 , 11 ]
According to the company's account reported by ITmedia, Impress Watch and Game Watch, the unauthorized access occurred between October 2 and 7. An investigation established on October 13 that membership information had leaked. The company said it immediately blocked communications from the access source after learning of the unauthorized access. It is working with external specialists to determine how access became possible and investigate the detailed cause. [ 4 , 5 , 11 ]
ITmedia reported that the operator had established a response headquarters, reported the incident to the Personal Information Protection Commission and begun notifying affected users. The company said it would strengthen system security and monitoring and work to prevent a recurrence with advice from outside specialists. It urged users to be alert to suspicious emails, text messages and calls posing as Burger King. ITmedia reported its advice not to follow links, open attachments or enter membership information or passwords in response to suspicious messages. [ 4 , 5 , 11 ]
Why it matters
The exposed records contain personal and contact details. The operator warned users to watch for suspicious emails, text messages and calls impersonating Burger King.
Key facts
- Unauthorized access occurred between October 2 and 7, and the leak was confirmed on October 13. [ 4 , 5 , 11 ]
- Exposed fields include member IDs, birth dates, names, email addresses and phone numbers. [ 4 , 5 , 11 ]
- The company said it does not hold credit-card numbers and had not confirmed a login-password leak. [ 4 , 5 , 11 ]
- The access source was blocked, and external specialists are helping investigate. [ 4 , 5 , 11 ]
Confirmed by several sources
Still unclear
- How the intruders gained access and the detailed cause remain under investigation. ITmedia and Game Watch report that the operator is investigating with external specialists.