Burger King Japan App Breach (About 11.18 Million Records): Names, Birth Dates and Phone Numbers Leaked — What Members Should Do

The leaked items include name (kanji and katakana), date of birth, phone number and email address. With all of that, a scammer can send a message with your correct name and birth date.

The company asks customers to watch for suspicious emails, texts and calls impersonating it or its services, and not to open URLs or attachments or enter member information or passwords. Whether the message offers, for example, "apology coupons", a "mobile order refund" or "re-registering your member details" (this site's examples), do not open the link; open the app yourself to check (see What is phishing?).

The company says it is emailing affected customers in turn. The notice does not give the sender address of those emails.

Sender names can be faked, so telling the genuine notice from a fake one by appearance is hard. Even if a notice email arrives, settle on one rule: do not log in or enter anything through a link in the email.

Unlike an email address or phone number, a birth date cannot be changed, and this time it leaked together with names.

If your bank or card PIN, phone screen lock or any password is based on your birth date (such as "0815" or "19900815"), change it now. This is this site's general advice, not the company's.

The company says no leak of login password information "has been confirmed so far". The notice does not ask members to change their passwords, but the wording reflects an investigation still in progress.

If you use the same password for the Burger King app and other services, separate them now. A password manager is the practical way to do it. To check whether a reused password appears in past leaks, see how to check if your password was leaked.

Phone numbers are hard to change. The leaked numbers may receive scam calls and texts for some time, including ones that do not mention Burger King at all.

Turning on your phone's spam call and text filters reduces how many reach you (see smartphone security basics).

The company lists its customer service as the contact for customers (phone 0120-945-630, email customerservice@burgerking.co.jp, weekdays 10:00–17:00 Japan time, closed weekends and public holidays). Use the contacts in the notice on the official site, not those written in a message you received.

According to the company, it does not hold credit card numbers, so they did not leak. It is an example of a general principle: when a member system is breached, what is not in it cannot leak.

Your own service can be built the same way, leaving card numbers with the payment provider and keeping only the identifier (token) it returns. Note, though, that even without storing card numbers, card data can be stolen at the moment of entry if the payment page is tampered with (see the PhotoGoods case). Not holding the data and protecting the entry page are separate measures.

In general, sign-up fields tend to pile up for campaigns and analytics. List each field next to the feature that uses it, and stop asking for, or stop storing, fields with no use.

For example, if you hold birth dates only for birthday coupons, consider whether the birth month is enough. If the purpose is an age check, you can keep only the result of the check. Katakana names, gender and similar fields can be reviewed the same way.

This notice does not give the sender address of the emails to affected customers. In general, fake apology emails spread quickly after an incident, and about the only clue members have for spotting the genuine notice is sender information published beforehand.

Before anything happens, decide the domain and sender address you will use for important member notices, publish them on your official site, and set up sender authentication (SPF, DKIM and DMARC). See stopping spoofed email with SPF, DKIM and DMARC.