McDonald’s Indonesia: Security Culture: A How-to Guide for Improving Security Culture and Dealing with People Risk in Your Organisation

McDonald’s Indonesia Exposes Over 40 Million Records in Data Breach

Cybersecurity researchers at Cybernews uncovered a significant data exposure involving McDonald’s Indonesia, which left over 40 million records vulnerable. Of these, 28 million were customer records, including sensitive details such as names, email addresses, phone numbers, and device IDs. The breach also exposed 71,000 corporate records, primarily related to advertising campaigns, putting both personal and internal business data at risk.

The exposed data increases the likelihood of social engineering attacks, such as phishing emails and scam calls, as well as loyalty fraud due to compromised transaction information. The database has since been secured and is no longer publicly accessible.

The incident highlights ongoing risks in customer data management, particularly for large-scale enterprises handling vast amounts of personal and operational information. No further details on the cause of the exposure or potential misuse of the data have been disclosed.

Source: https://www.securitymagazine.com/articles/102613-40m-mcdonalds-records-exposed-through-customer-data-platform

McDonald’s Indonesia TPRM report: https://www.rankiteo.com/company/mcdonalds-id

"id": "mcd1790786108",
"linkid": "mcdonalds-id",
"type": "Breach",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '28 million customer records '
                                              'exposed',
                        'industry': 'Food & Beverage',
                        'location': 'Indonesia',
                        'name': 'McDonald’s Indonesia',
                        'type': 'Corporation'}],
 'data_breach': {'number_of_records_exposed': 'Over 40 million',
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': ['Names',
                                         'Email addresses',
                                         'Phone numbers',
                                         'Device IDs'],
                 'type_of_data_compromised': ['Customer records',
                                              'Corporate records (advertising '
                                              'campaigns)']},
 'description': 'Cybersecurity researchers at Cybernews uncovered a '
                'significant data exposure involving McDonald’s Indonesia, '
                'which left over 40 million records vulnerable. Of these, 28 '
                'million were customer records, including sensitive details '
                'such as names, email addresses, phone numbers, and device '
                'IDs. The breach also exposed 71,000 corporate records, '
                'primarily related to advertising campaigns, putting both '
                'personal and internal business data at risk. The exposed data '
                'increases the likelihood of social engineering attacks, such '
                'as phishing emails and scam calls, as well as loyalty fraud '
                'due to compromised transaction information. The database has '
                'since been secured and is no longer publicly accessible.',
 'impact': {'brand_reputation_impact': 'Ongoing risks in customer data '
                                       'management highlighted',
            'data_compromised': 'Over 40 million records exposed, including 28 '
                                'million customer records and 71,000 corporate '
                                'records',
            'identity_theft_risk': 'Increased likelihood of social engineering '
                                   'attacks and loyalty fraud'},
 'lessons_learned': 'Highlights ongoing risks in customer data management for '
                    'large-scale enterprises handling vast amounts of personal '
                    'and operational information',
 'references': [{'source': 'Cybernews'}],
 'response': {'containment_measures': 'Database secured and no longer publicly '
                                      'accessible'},
 'title': 'McDonald’s Indonesia Exposes Over 40 Million Records in Data Breach',
 'type': 'Data Exposure'}