Burger King Russia Data Breach Exposes 3.2 Million Customer Records in 2024 Supply-Chain Attack In October 2024, Burger King’s Russian operations confirmed a data breach stemming from a cyberattack on Mindbox, a Moscow-based marketing automation platform. The incident, first reported by Russia’s TASS news agency, exposed 3.2 million customer records, including emails, names, genders, birth dates, phone numbers, and geolocation data spanning from 2018 to August 2024. Payment details were not compromised, though the leaked information poses risks for phishing, identity theft, and social engineering attacks. The breach originated from a supply-chain attack on Mindbox, which provides customer engagement tools such as email campaigns, loyalty programs, and chatbots to over 1,100 businesses, including L’Oréal, Panasonic, KFC, and JBL. While Mindbox stated this was its first major security incident, it later revealed the attack was likely identity-based, suggesting compromised employee credentials rather than a zero-day exploit. In response, Mindbox tightened access controls, implemented mandatory two-factor authentication, and revised its internal role permissions to prevent future unauthorized data access. The company also adjusted development processes to identify vulnerabilities before deployment. The full scope of the breach was later documented by Have I Been Pwned, which confirmed the 3.2 million exposed email addresses and associated personal data. Earlier reports from The Register suggested the breach may have involved 5.6 million data entries, potentially including customer preferences and order histories, though these details were not included in the latest disclosure. While the leaked data is not current, static information like names, birth dates, and genders remains valuable for malicious actors targeting victims with fraudulent schemes. The incident underscores the risks of third-party vendor breaches in supply-chain attacks.