Burger King Japan disclosed a breach exposing 11.18 million app users’ personal data after attackers accessed its membership system in early October. Burger King Japan has disclosed a data breach that exposed the personal information of approximately 11.18 million official app members. Burger King Japan, the company operating the fast-food chain in the country, said attackers accessed the system managing customer membership information between October 2 and October 7, 2026. The company disclosed the incident on October 15, after discovering the data leak two days earlier. In its official notice published on October 15, the company confirmed the unauthorized access and apologized to affected customers. The announcement doesn’t identify the attackers or explain how they gained access. BK Japan says it’s working with external security specialists to determine the cause. “We have confirmed that customer membership information from the official app has been leaked externally following unauthorized access by a third party.” reads the data breach notification. The compromised data includes membership IDs, email addresses, names in Japanese characters and kana, phone numbers, dates of birth, gender, prefecture of residence, and membership registration type. The exposed information also indicates whether a customer has a mobile ordering history and whether their email address has been verified. These details can be useful to criminals even without payment data or passwords. Attackers can use them to craft convincing phishing emails, text messages, or phone calls that refer to a customer’s real identity and relationship with Burger King. A message that includes a person’s name, phone number, and other accurate details may look far more credible than a generic scam. Burger King Japan confirmed it does not store credit card numbers and found no evidence that passwords were exposed, with no confirmed cases of fraud so far. However, these factors do not completely rule out the risk of future misuse. According to the company, unauthorized access took place from October 2 through October 7, and the leak was confirmed on October 13. BK Japan says it blocked access from the source of the unauthorized communications as soon as it became aware of the incident. The company has also introduced temporary countermeasures, established an incident response team, and reported the breach to Japan’s Personal Information Protection Commission. It says permanent security improvements, further investigation with external specialists, and email notifications to affected customers are ongoing. “At present, we have confirmed that the unauthorized access was carried out by a third party.” continues the notification. The company has not yet disclosed the precise circumstances that made the intrusion possible, and the investigation is continuing. Until more details emerge, it’s too early to draw conclusions about the initial access vector or attribute the attack to a particular threat actor. Large-scale data breaches create long-lasting risks for follow-on attacks, as criminals can use stolen details for phishing, impersonation, and highly convincing scams. BK Japan urges customers to stay vigilant against fraudulent emails, texts, and calls, warning them never to click unverified links or share sensitive credentials. The core danger is that attackers no longer need network access to cause harm; they can leverage existing stolen data to target customers directly through social engineering. “Please do not access URLs, open attachments, or enter membership information or passwords if you receive a suspicious communication.” concludes the report. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Burger King Japan)
In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One model, a nod to Kahneman's fast, intuitive thinking. OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6. Cribl published cribl-decision, an open LoRA adapter you can run locally. Others, like Laya, are
The Legal Aid Agency (LAA), an executive agency of the UK's Ministry of Justice that manages the country's Public Defender Service, says attackers who breached its IT systems in April 2025 stole records dating back to 1978. The agency employs around 1,250 staff, oversees billions in legal funding, and works with approximately 2,000 providers, including barristers, solicitor firms, and non-profit organizations that deliver civil and criminal legal aid services in England and Wales. The LAA disclosed the cyberattack in early May 2025, warning that payment information for legal aid providers might have been compromised. Two weeks later, it confirmed the resulting data breach was more serious than first believed after finding that attackers had stolen a large trove of sensitive applicant and recipient data from 2010 onward, including contact details, dates of birth, national ID numbers, criminal history, employment status, as well as contribution amounts, debts, and payments.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday urged organizations to take steps to immediately update their Ivanti Connect Secure (ICS) appliances and deployments to the latest version following the disclosure of an actively exploited vulnerability. The security flaw, tracked as CVE-2026-104935 (CVSS score: 8.6), is a case of authentication bypass impacting ICS
A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP's official Python client for BTP services. An attacker must be able to control the tenant subdomain,
SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python. The SAP Python SDK is the official programmatic toolkit for developing AI agents and Python applications on the company's SAP Business Technology Platform (BTP) services. Tracked as CVE-2026-89111, the maximum-severity vulnerability patched this month can be exploited by remote attackers without privileges to steal credentials. Customers who can't immediately deploy the October 2026 SAP patches can temporarily mitigate the issue by using an allowlist to validate tenant_subdomain values. "The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated," according to a Tuesday advisory.
Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners. Details of the flaws are below - CVE-2026-105133 (CVSS v4 score: 5.5) - An improper authentication vulnerability in the checkSysPwd() function in the "com/ahsay/obs/api/ApiStructsAction.java"
Attackers behind a string of personal data leaks at Japanese organizations have abused APIs for mobile apps and targeted known software flaws, the JPCERT Coordination Center (JPCERT/CC) said. The Tokyo-based center, which takes incident reports, based its October 8, 2026 alert on those reports and other information. The alert names no attacker and no affected organization. JPCERT/
Cybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence (AI) pen testing tool named ARTEX to carry out the attacks. The activity, per CrowdStrike Intelligence, was active from late September to early October 2026, and resulted in data exfiltration from various South Korea-based financial firms,
Frontline Education is notifying school districts of a data breach after attackers exploited a vulnerability in third-party software to gain unauthorized access to its systems and steal employee information, including Social Security numbers. Frontline Education is an edtech company that provides administration and workforce management software and services used by school districts. Last night, a reader shared a data breach notification with BleepingComputer that Frontline sent to an impacted school district, stating that attackers breached its environment through a vulnerability in a third-party application. "On August 14, 2026, our security team identified a vulnerability in a third-party software product we use that allowed unauthorized access to a portion of the environment," the notification letter reads.
Confirm this action.
Leaving now will discard your changes.