Baydöner: Have I Been Pwned’s Post

Baydöner Data Breach Exposes 1.2M Customer Records, Including Plaintext Passwords

Last week, Turkish restaurant chain Baydöner suffered a significant data breach, exposing 1.2 million unique email addresses alongside customers’ names, phone numbers, cities, and plaintext passwords. The incident was flagged by security researcher Troy Hunt, who added the compromised data to the Have I Been Pwned database for public verification.

Analysis of the leaked records revealed that 28% of the exposed email addresses were already linked to LinkedIn accounts, increasing the risk of targeted phishing or credential-stuffing attacks. The inclusion of plaintext passwords rather than hashed or encrypted versions heightens concerns about potential account takeovers, as users who reuse passwords across platforms face immediate vulnerability.

The breach underscores persistent risks in data security practices, particularly the storage of sensitive information in unsecured formats. No details have been disclosed regarding the attack vector or whether Baydöner has notified affected customers. The incident adds to a growing trend of hospitality-sector breaches, where customer data remains a high-value target for cybercriminals.

Source: https://www.linkedin.com/feed/update/urn:li:activity:7438791495111028736

BAYDÖNER cybersecurity rating report: https://www.rankiteo.com/company/baydoner

"id": "BAY1773548615",
"linkid": "baydoner",
"type": "Breach",
"date": "3/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '1.2 million',
                        'industry': 'Hospitality',
                        'location': 'Turkey',
                        'name': 'Baydöner',
                        'type': 'Restaurant Chain'}],
 'data_breach': {'data_encryption': 'None (plaintext passwords)',
                 'number_of_records_exposed': '1.2 million',
                 'personally_identifiable_information': ['Email addresses',
                                                         'Names',
                                                         'Phone numbers',
                                                         'Cities'],
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Email addresses',
                                              'Names',
                                              'Phone numbers',
                                              'Cities',
                                              'Plaintext passwords']},
 'description': 'Last week, Turkish restaurant chain Baydöner suffered a '
                'significant data breach, exposing 1.2 million unique email '
                'addresses alongside customers’ names, phone numbers, cities, '
                'and plaintext passwords. The incident was flagged by security '
                'researcher Troy Hunt, who added the compromised data to the '
                'Have I Been Pwned database for public verification.',
 'impact': {'brand_reputation_impact': 'High',
            'data_compromised': '1.2 million unique email addresses, names, '
                                'phone numbers, cities, and plaintext '
                                'passwords',
            'identity_theft_risk': 'High'},
 'references': [{'source': 'Have I Been Pwned'}, {'source': 'Troy Hunt'}],
 'title': 'Baydöner Data Breach Exposes 1.2M Customer Records, Including '
          'Plaintext Passwords',
 'type': 'Data Breach'}