Per BK Japan’s notice, the exposed fields are member ID, email address, registration type, prefecture, gender, date of birth, full name in kanji and kana, phone number, whether the member had used mobile ordering, and whether the email address had been verified. The company says it doesn’t hold credit card numbers, so none leaked, and that it hasn’t confirmed any leak of login passwords so far. It says no secondary damage such as fraudulent use has been confirmed yet.
What it has done. BK Japan says it blocked traffic from the source as soon as it found the access, put interim fixes in place, set up a response team, reported to Japan’s Personal Information Protection Commission and is emailing affected members. How the attacker got in is still under investigation with outside specialists. Root cause: Undisclosed.
Why a security team should care. This is a clean phishing kit: real name, verified email, phone number, birthday and the fact that someone actually uses the app. Expect smishing and fake-refund mail impersonating the brand, and expect the same identities to show up in account-takeover attempts against other Japanese consumer services. BleepingComputer counts this as the latest in a long run of Japanese corporate breaches this year, and cites Macnica researcher Yutaka Sejiyama’s tally of 119 personal-data incidents in Japan in 2026, with attackers going after web and API access-control and auth weaknesses and known bugs.
What we’d check. If you run a customer-facing app with a member database, look at the API layer, not just the login page. Rate-limit and alert on bulk reads of member records, make sure object-level authorization is enforced on every member endpoint, and know how you’d spot six days of slow export before a third party tells you.