Burger King Japan has disclosed that unauthorized access to a server used for its official smartphone app exposed approximately 11.18 million customer records. The company reached that conclusion after an investigation completed on October 13, following activity it said took place from October 2 through October 7.

The affected information included app members' names, dates of birth, gender, email addresses, telephone numbers and order histories. Burger King Japan said the compromised server did not store credit-card numbers. It also said its investigation had found no evidence that login credentials were accessed.

According to the company's account, it blocked access from the source involved after detecting the intrusion. It then brought in outside cybersecurity specialists to help determine how the server had been reached. The operator has reported the incident to Japan's Personal Information Protection Commission.

Burger King Japan said it had not confirmed secondary harm such as fraudulent use of the exposed information at the time of its announcement. That finding does not remove the risk created by the disclosure of contact and account-profile data. Information such as names, email addresses, phone numbers and purchase histories can help criminals make impersonation attempts appear more convincing.

The company therefore advised affected customers to be alert for emails, text messages and telephone calls that claim to come from Burger King Japan. It urged people not to follow suspicious links, open unexpected attachments or enter member information or passwords in response to unsolicited messages.

Burger King Japan operates about 350 restaurants in the country as part of a global chain with nearly 20,000 locations. The exposed records, however, were tied specifically to users of the Japanese operator's official app.

The incident concerns the app membership system rather than payment-card storage. That distinction limits one direct financial risk, while leaving customers exposed to possible phishing or other social-engineering attempts based on the leaked personal details. The company has not yet publicly identified the initial route used by the attackers, and its technical investigation remains under way.

The disclosure follows several cyber incidents reported this year by prominent Japanese organizations across publishing, transportation, telecommunications and digital infrastructure. Burger King Japan's response now centers on determining the access method, notifying regulators and warning customers about follow-on scams.

For customers, the practical precaution is to treat unexpected Burger King-branded communications with care and navigate to the company's services independently instead of using embedded links. The company said it would continue investigating the breach with external experts and apologized for the concern caused to customers and other people affected.