A burger app lost 11 million customer records in five days, and the only thing it kept safe was the card

Five days was enough. Burger King Japan's operator said on 15 October that an intruder had access to the servers behind its smartphone app from Friday 2 October to Wednesday 7 October, and came away with about 11.18 million member records. BleepingComputer and CyberInsider report the same list of fields: name, date of birth, gender, email address, phone number, prefecture, and whether you had used mobile ordering. The company doesn't keep card numbers on that server, so there were none to take, and it has found no sign that passwords were accessed, though that part is still under investigation.

Eleven million is records, not necessarily people; the company hasn't said how many individuals that works out to. It has reported the breach to Japan's privacy regulator, is emailing everyone affected, says no fraud has been confirmed so far, and still doesn't know how the attacker got in.

Here is the part that applies whether or not you've ever been near a Japanese Burger King. A list with your name, birthday, phone number and the fact that you order fast food on your phone is a phishing kit, not a nuisance. The messages will arrive as "your account needs re-verification" emails and texts, and they'll be convincing because they'll get your details right. The company's own advice is the correct one: don't tap links or open attachments in anything claiming to be from them, and never type your password into a page a message sent you to. Open the app yourself instead. If you reused that app password anywhere else, change it there today; the breach may not have reached passwords, but you shouldn't be the one finding out.

Tendvane can't see what a company in Tokyo stores about you, but its Privacy and accounts check does the same inventory for the accounts on your own PC, including the ones with no password at all.