Burger King Russia data breach: 3.2M accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-09-21
In October 2024, news of a data breach exposing Burger King Russia customers broke following an August attack on the Mindbox marketing automation platform. The breach exposed 3.2M unique email addresses along with names, genders, dates of birth, phone numbers and approximate geolocations, with the data spanning 2018 to August 2024. Burger King Russia acknowledged the incident and advised it did not include payment or passport details. Exposed data: dates of birth, email addresses, genders, geographic locations, names, phone numbers. The breach dates from Aug 25, 2024; Have I Been Pwned loaded it on Sep 21, 2026.
What to do
- If you had a Burger King Russia account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch