GonnaOrder Exposes Millions of Customer Records via Unsecured Kafka Broker A major security lapse at European food delivery platform GonnaOrder left real-time order data from thousands of customers exposed for nearly two years, according to researchers at Cybernews. The breach stemmed from an unsecured Apache Kafka Broker instance, which remained accessible from August 2022 until late last month when the company finally secured it. The exposed data included names, phone numbers, delivery addresses, order details, and payment information, primarily affecting customers in the UK, Belgium, Greece, and the Netherlands. While Kafka isn’t designed for long-term data storage, researchers warned that attackers could have exploited the misconfiguration by deploying a "collector" to continuously scrape sensitive information over the extended exposure period. Cybernews highlighted the risks of such prolonged exposure, noting that leaked data—including building access codes embedded in delivery notes—could be exploited for fraud, phishing, or physical security breaches even after the instance was secured. The incident underscores the dangers of misconfigured cloud services in handling sensitive customer data.