BK Japan said unauthorized access to its official app membership system on October 2–7 exposed about 11.18 million records. The data included names, dates of birth, phone numbers, email addresses, and membership IDs; the company confirmed the leak on October 13 and blocked the access source. Card numbers, which the company does not store, were not exposed, and neither login-password leakage nor secondary harm had been confirmed. The access route remains under investigation. Customers should avoid opening links or attachments in messages impersonating official notices or entering account information through them.