Burger King Russia customer data exposed via Mindbox platform breach, 3.2M email addresses added to HIBP
A breach of the Mindbox marketing automation platform in August 2024 exposed data belonging to Burger King Russia customers. News of the incident broke in October 2024, and the dataset was added to Have I Been Pwned on 21 Sep 2026. It contains 3.2M unique email addresses along with names, genders, dates of birth, phone numbers and approximate geolocations, covering 2018 to August 2024. Burger King Russia acknowledged the incident and stated that payment and passport details were not included.
Technical Details
- The compromise occurred at a third-party service provider (Mindbox), not within Burger King's own infrastructure, which makes this a third-party/supply chain exposure.
- The article does not describe the intrusion method, the threat actor or any IOCs.
Remediation
- Affected users should watch for targeted phishing and SMS scams that abuse the exposed names, phone numbers and email addresses.
- Change passwords on any account that reuses credentials associated with the exposed email addresses, use a password manager, and enable 2FA wherever it is supported.
Linha do tempo
-
Burger King Russia customer data exposed via Mindbox platform breach, 3.2M email addresses added to HIBP
ler a análise desta fonte ocultar
A breach of the Mindbox marketing automation platform in August 2024 exposed data belonging to Burger King Russia customers. News of the incident broke in October 2024, and the dataset was added to Have I Been Pwned on 21 Sep 2026. It contains 3.2M unique email addresses along with names, genders, dates of birth, phone numbers and approximate geolocations, covering 2018 to August 2024. Burger King Russia acknowledged the incident and stated that payment and passport details were not included.
Technical Details
- The compromise occurred at a third-party service provider (Mindbox), not within Burger King's own infrastructure, which makes this a third-party/supply chain exposure.
- The article does not describe the intrusion method, the threat actor or any IOCs.
Remediation
- Affected users should watch for targeted phishing and SMS scams that abuse the exposed names, phone numbers and email addresses.
- Change passwords on any account that reuses credentials associated with the exposed email addresses, use a password manager, and enable 2FA wherever it is supported.