Burger King Japan disclosed that attackers accessed the system that manages member information for its official smartphone app, leaking 11.18 million customer records, BleepingComputer reports. The company says it determined on October 13 that unauthorized access took place between October 2 and October 7, and that it blocked the source as soon as it learned of it.

The exposed data includes names, dates of birth, gender, email addresses, phone numbers and order history. The company says credit card numbers were not stored on the server and it found no evidence that login credentials were accessed, and that no secondary damage such as fraudulent use had been confirmed.

Burger King Japan has reported the breach to Japan's Personal Information Protection Commission and warns customers about emails, texts and calls impersonating it. BleepingComputer notes a run of attacks on major Japanese companies this year; a Macnica researcher has logged 119 incidents involving personal data theft or exposure.