Pizza Hut, Taco Bell owner confirms data breach

Yum! Brands, the fast-food corporation behind the KFC, Pizza Hut, and Taco Bell franchises, has confirmed attackers breached its systems, exposing sensitive employee data.

Yum! Brands started sending breach notification letters to victims affected by the January ransomware attack that knocked out 300 of the company’s restaurants.

The fast-food corporation said it was breached on January 13 when unknown attackers accessed the company’s systems. The company did not specify whether one or several of its restaurant brands were affected.

“As we announced publicly in mid-January, Yum! experienced a cybersecurity incident involving unauthorized access to certain of our systems on or around January 13, 2023,” the company said in the letter.

According to Yum! Brands, an investigation into the incident led the company to believe that no customer data was exposed in the cybersecurity incident.

“In the course of our forensic review and investigation, we identified some personal information belonging to employees was exposed during the January 2023 cybersecurity incident. We are in the process of sending individual notifications and are offering complimentary monitoring and protection services. We have no indication that customer information was impacted,” the company's spokesperson told Cybernews.

According to the information that the KFC, Pizza Hut, and Taco Bell owner provided to the Office of the Maine Attorney General, the exposed data includes full names of victims and driver’s license and other non-driver ID card numbers.

Exposing driver’s licenses and ID numbers poses serious security risks to victims, as threat actors can use the data for identity fraud. Yum! said the company would offer credit monitoring services, including an insurance policy, as compensation.

Yum! Brands franchises over 55,000 restaurants globally, generating over $59 billion in sales. The company and its subsidiaries employ around 36,000 workers, with an additional one million working for its subsidiaries and related businesses.

Updated on April 12 (07:10 GMT) with a statement from Yum! Brands.