McDonald's data leak exposes 28 million customer details

Key takeaways:

McDonald's Indonesia exposed over 40 million records from its customer data platform.
The leak included about 28 million customer records, such as emails, names, phone numbers, and device IDs.
Researchers warn attackers could use the data for scams, account impersonation, and loyalty fraud.
McDonald's Indonesia has closed the exposed database, and researchers have requested comment.

Key Takeaways by nexos.ai, reviewed by Cybernews staff.

Tens of millions of records were leaked after McDonald's Indonesia exposed its Customer Data Platform (CDP). Everything from loyalty cards to customer email addresses was left up for grabs.

While data-hungry companies talk a good game on security, lapses do happen. For example, our research team has discovered and exposed a MongoDB database with millions of records owned by McDonald’s Indonesia.

Loyalty card data, sales information, customer details, and many other data points were left available for anyone caring to look. In total, our team found over 40 million exposed records, most of which were related to McDonald’s customers.

“Affected individuals could face an increase in social engineering attempts via email or scam calls. Moreover, there is a risk of loyalty fraud because of exposed loyalty point transaction information,” our team explained.

The only silver lining is that McDonald’s Indonesia closed the exposed database, meaning that it’s no longer accessible to the public. We’ve reached out for comment and will update this article once we receive a reply.

User records from McDonalds — User record example. Image by Cybernews.

What McDonald’s Indonesia data was exposed?

According to our team, several types of records were leaked via the exposed MongoDB instance. The largest group includes over 28 million records covering personal identifiable information of customers, including:

Personal email addresses (around 12.6M)
Full names (around 12.5M)
Phone numbers (around 1M)
Last known device IDs (around 28.15M)

Another major source of leaked records was GDPR consent event logs and snapshots, over 12 million in total, over 2 collections in the exposed MongoDB database. The leaked information revealed user IDS, consent flags, and timestamps.

Customer records from McDonalds — Customer record counts with PII present. Image by Cybernews.

The exposed information also included loyalty card data and loyalty point transaction logs, totaling over 226K across f5 collections in the exposed database. The leaked information included reporting IDs (unique user identifiers), loyalty point transaction IDs, transaction types, and their timestamps.

Customers weren’t the only ones whose data was leaked. The exposed database contained numerous corporate details. For example, the team found over 71K records on ad campaigns, containing campaign titles, statuses, timestamps, and user interaction data.

Other leaked information includes 37.8K sales records, several hundred records on McDonald’s Indonesia locations, and push notification data.

What dangers does the McDonald’s data leak pose?

Attackers could use the exposed records to carry out attacks beyond basic phishing or social engineering. With customer names, email addresses, phone numbers, device IDs, loyalty identifiers, transaction histories, and consent logs, they could build detailed profiles of individual users and map their interactions with McDonald’s systems over time.

That kind of visibility can enable impersonation and targeted social engineering, including convincing account recovery requests, fake customer support outreach, and loyalty account abuse that could escalate into financial fraud.

Less obvious risks include behavioral profiling based on order activity, timestamps, venues, and campaign engagement data, which could help attackers identify frequent customers and time scams for greater credibility.

McDonalds sale records data — Sale record example. Image by Cybernews.

Device identifiers and consent histories could also be used to make fraudulent messages appear more legitimate by impersonating real platforms, notifications, or privacy actions associated with a target’s account.

While we don’t have evidence that attackers have exploited the leaked data, if our team could find it, so could threat actors. Moreover, McDonald’s is a frequent target of cybercriminals as its numerous locations aggregate troves of data.

In early 2026, ransomware gang Everest Group claimed McDonald’s India, demanding the company pay a ransom, or it would leak stolen data online.

McDonald’s-associated businesses have leaked data before, too. In 2025, McHire, McDonald’s hiring chatbot platform, exposed 64M job applicants after its systems were found to be protected by the default password “123456”.