iMenu360 Breach Exposes 3.4M Customer Records
What Happened – In late 2022, the online‑ordering platform iMenu360 inadvertently exposed 3,425,860 customer records. The leaked data included email addresses, full names, phone numbers, physical addresses and latitude/longitude coordinates. Repeated outreach to iMenu360 in 2023 received no response.
Why It Matters for Trust & Control Assurance
- Continuous control‑monitoring programs are designed to detect and document unauthorized data exposure before it reaches the public.
- A defensible audit trail of data‑handling and incident‑response evidence is essential to demonstrate due‑diligence to regulators and partners.
- The Trust Center capability can provide the evidence‑collection framework needed to prove that privacy and security controls are operating as intended.
Who Is Affected – Restaurants and food‑service businesses that rely on iMenu360’s SaaS ordering system, as well as the millions of consumers whose personal contact information was disclosed.
Recommended Actions –
- Map your data‑privacy and access‑control safeguards to the relevant control objective (e.g., “protect personal data” and “maintain incident‑response capability”).
- Collect and retain evidence of encryption, least‑privilege access, and regular incident‑response drills.
- Deploy continuous monitoring to log data‑access events and generate alerts for anomalous activity.
Technical Notes – The breach appears to stem from inadequate protection of the ordering‑system database; no specific CVE or exploit was disclosed. Exposed data types: email, name, phone, physical address, latitude/longitude. Source: Have I Been Pwned – iMenu360 breach