Burger King responded to reports of a large-scale data breach

“Burger King confirms that among the personal data whose accuracy is verified there is no information on payment details: public information about transactions is not transferred or stored by third parties. The Mindbox platform and other third parties do not have access to the personal passport and payment data of network customers,” they reported in the press service.

Previously, on October 10, the Telegram channel “Information Leaks” reported on a possible leak of more than 5 million rows of Burger King customer data. According to their information, names, almost 5 million unique phone numbers, more than 3 million unique email addresses, dates of birth and other information were leaked to the Internet. “Most likely they were received from a mobile application,” the channel’s authors indicated.

The leak was also commented on by Anton Gorelkin, deputy chairman of the State Duma Committee on Information Policy. “We are waiting for an official statement from the fast food chain. Unfortunately, as no fines have yet been imposed for leaks, if the incident is confirmed, the company can get away with coupons for free burgers,” the parliamentarian wrote on his Telegram channel.

• The bill on fines for leaking personal information is scheduled to be approved by the end of the year, Kommersant wrote in September, referring to Andrei Svintsov, deputy chairman of the Duma’s Information Policy Committee.
• In July, the document was criticized by representatives of Russian Railways, Aeroflot, Avtodor, the Russian Union of the Travel Industry and other companies. According to RBC sources, organizations are concerned that the bill in its current version will allow companies that seek to protect customers’ personal information but are subject to hacker attacks or software failures to be held accountable.
• Authorities have been discussing the issue of corporate liability for breaches since February 2022, amid an increase in their number. According to FACCT (formerly Group-IB), in the first six months of 2024, 150 databases of Russian organizations became publicly available.