Burger King Russia Breach Exposes 3.15 M Customer Records via Compromised Marketing Platform
What Happened — An August 2024 attack against the Mindbox marketing‑automation platform used by Burger King Russia resulted in the exposure of 3,155,792 customer records. The data set includes names, email addresses, dates of birth, genders, phone numbers and approximate geolocations spanning 2018‑2024. No payment or passport details were reported.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of relying on third‑party services that process personal data; a continuous vendor‑risk program is needed to verify security controls before and after onboarding.
- Highlights the importance of real‑time evidence collection (e.g., security attestations, audit logs) to prove due‑diligence during an incident.
- Underlines the need for a defensible audit trail that maps third‑party incidents to control objectives across frameworks.
Who Is Affected – Quick‑service restaurant chains and their marketing‑automation vendors; broadly, the retail/e‑commerce sector.
Recommended Actions – Review and tighten third‑party risk management contracts; require regular security attestations and continuous monitoring of vendor environments; update incident‑response playbooks to include supply‑chain breach scenarios; verify that data‑handling controls meet the relevant control objective for vendor oversight. Source: [Have I Been Pwned – Burger King Russia breach]
Technical Notes – The breach originated from a compromise of the Mindbox platform (a SaaS marketing automation tool). No specific CVE was disclosed; the attack vector appears to be a credential‑theft or exploitation of the vendor’s environment, leading to unauthorized data extraction. Source: [Have I Been Pwned – API]