2024 Burger King Russia — Mindbox marketing platform attack; 3.2M unique emails (HIBP)
Data compromised
Per HIBP / company statements: 3.2M unique emails plus names, genders, dates of birth, phone numbers, approximate geolocations (data spanning ~2018–Aug 2024). Payment and passport details stated not included. DLBI earlier cited ~5.6M rows / ~3.16M unique emails.
Technical writeup
Verified Burger King Russia statements (Oct 2024) + Have I Been Pwned load added September 21, 2026. August 2024 attack on marketing-automation platform Mindbox allegedly exposed customers of several Mindbox clients including Burger King Russia. Company said payment cards and passport data were not held by Mindbox / not in the leak. HIBP indexes 3.2M unique emails with names, DOB, gender, phones, approximate geo. Mindbox publicly said it cut unauthorized admin-panel log access in August and disputed whether the published BK dump matched that incident. recordsAffected 3200000; companyConfirmed true.
Root cause
August 2024 unauthorized access to Mindbox marketing-automation contractor (Burger King Russia acknowledgment; HIBP)
References
- https://haveibeenpwned.com/Breach/BurgerKingRussia
- https://www.vedomosti.ru/technology/news/2024/10/10/1067822-slili-dannie-klientov-burger-king
- https://www.kommersant.ru/doc/7215788
- https://telesputnik.ru/materials/companies/news/kompaniya-burger-king-soobshhila-o-xakerskoi-atake-na-svoego-podryadcika-mindbox-i-utecke-dannyx-klientov-neskolkix-kompanii