More than 5.6 million Burger King customer records were published online after a hacker attacked Mindbox, a Russian marketing automation platform used by Burger King and other retailers. The incident was described in public reporting by IT Governance, while Mindbox’s published security certification outlines the platform’s stated security controls. Payment data and passwords were not exposed, but the leaked records — which include birthdates, order histories, and the data of children — create significant risk for targeted phishing campaigns.
The Scope of the Breach
According to DLBI’s findings, the leaked database contains 5,627,676 entries, with information dating from May 31, 2018, to August 25, 2024. Public reporting indicates the data was likely extracted from Burger King’s mobile application environment. The compromised information includes:
- Customer names
- Phone numbers
- Email addresses
- Birthdates
- Order histories
Burger King’s Response
According to statements cited by the coverage above, Burger King’s press service said the breach did not expose payment information. The company also said third parties did not have access to payment or passport data connected to users.
The Mindbox Connection
Burger King attributes the leak to a cyberattack on Mindbox, a marketing automation platform. Reports indicate the same incident affected multiple companies, suggesting broader exposure across retail and consumer services. Burger King also said Mindbox and other third parties did not have access to customers’ payment information.
Same attacker hit Detsky Mir — children’s data at risk
The Burger King incident appears to be part of a larger attack affecting several companies. Reports also linked the same breach activity to the children’s retail chain “Detsky Mir” (Children’s World), where the exposed data reportedly included customer names, phone numbers, email addresses, and information about children, including names and birthdates.
Expert Analysis
DLBI founder Ashot Oganesyan told media outlets that the Burger King and Detsky Mir breaches were likely the work of a single hacker. According to that account, the attack occurred in August, but the stolen data was not made public until later, underscoring the lag that can exist between compromise and public exposure.
Affected Burger King customers: practical steps
If you used Burger King’s mobile app or loyalty programme in Russia before August 2024, your data is likely in the leaked set. Recommended actions:
- Watch for phishing — attackers hold your name, phone, email, birthdate, and order history; expect highly targeted messages that look like genuine Burger King communications
- Change your Burger King app password and any other accounts where you reused the same credentials
- Be especially cautious with children’s data — the leak includes children’s names and birthdates from the Detsky Mir portion; do not respond to messages referencing your child’s name from unknown senders
- Organizations using Mindbox or similar marketing automation platforms should review what personal data is shared with third-party processors and verify data minimization and contractual deletion obligations
