Have I Been Pwned has added a breach affecting Burger King Russia, stemming from an August 2024 compromise of the Mindbox marketing automation platform. The exposed dataset includes roughly 3.2 million unique email addresses along with names, genders, dates of birth, phone numbers, and approximate geolocation data covering the period from 2018 to August 2024. Burger King Russia confirmed the incident, stating that payment card and passport details were not affected.
While no passwords were exposed, the combination of email addresses, phone numbers, birth dates, and location data provides a rich resource for identity fraud, phishing, and credential-stuffing campaigns against affected individuals. Attackers frequently leverage such personal data to craft convincing social-engineering lures that can ultimately lead to account takeovers elsewhere.
What to take away: third-party marketing and SaaS platforms remain a significant supply-chain risk. Organizations should monitor exposure of employee and customer email addresses in breach corpora and treat any leaked personal data as fuel for downstream phishing and identity-based attacks.