3.2 million Burger King Russia customers affected in data breach

TechRadar's Sead Fadilpašić reports that data from 3.2 million Burger King Russia customers has appeared online after a 2024 breach involving Mindbox, a domestic marketing automation platform.

Burger King told TASS in October 2024 that unidentified hackers had attacked Mindbox, which the company used for customer data and marketing campaigns. Payment information was not compromised, and Burger King Russia said passport details were not included.

Have I Been Pwned? says the breach exposed 3.2 million unique email addresses, along with names, genders, dates of birth, phone numbers and approximate geolocations. The data spans 2018 to August 2024. Mindbox said the incident was its first serious information security incident and that it was detected and contained quickly.

The company later tightened internal permissions, limited project access, added an approval mechanism involving another employee and made two-factor authentication mandatory. The Register previously reported that around 5.6 million data lines may have been exposed, although that figure was not included in the latest Have I Been Pwned? entry. The exact attack method remains unknown.