Burger King Russia burgerkingrus.ru Burger King Russia data breach: what happened and what to do
In August 2024 attackers hit Mindbox, a marketing platform used by Burger King Russia. The data of about 3.2 million unique email addresses leaked, with names, dates of birth, phone numbers and approximate locations. Burger King said no payment or passport details were included.
View all 13,115 breaches- Breach date
- 25 Aug 2024
- Affected
- 3,155,792
- Data exposed
- Dates of birth, Email addresses, Genders, Geographic locations, Names, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
The Burger King Russia breach did not start at Burger King. In August 2024, attackers broke into Mindbox, a Russian marketing automation platform that several companies used to run loyalty and email programmes. Customer data from Burger King Russia was among what was taken.
News of the leak broke in October 2024. Burger King Russia acknowledged the incident, and told Russian media that the hackers had reached customer data from several companies at once through Mindbox. Have I Been Pwned (HIBP) added the data to its service in September 2026, after the dataset surfaced.
HIBP counts 3,155,792 unique email addresses. Other trackers counted rows rather than people, and reported a figure above 5 million. The two numbers measure different things, so they don't contradict each other. The data spans 2018 to August 2024, covering people who used the chain's app and website.
What was exposed
HIBP lists dates of birth, email addresses, genders, geographic locations, names and phone numbers. Burger King Russia said the data did not include payment details or passport information.
It is easy to underrate this kind of leak. A phone number, a full name and a date of birth are enough for a convincing scam call or text. A criminal can open with your name, mention a food order or a loyalty bonus, and ask you to confirm a code. Date of birth is also one of the details banks and mobile carriers use to check who you are, so it is worth guarding. Combined with other leaks, these details help build a fuller profile of one person.
The company's response
Burger King Russia confirmed the attack on Mindbox and said payment and passport data were not part of it. HIBP marks the breach as verified. No compensation or settlement has been announced.
How the Mindbox route works
Companies often hand customer lists to a marketing platform so it can send offers, run loyalty points and personalise emails. That means your details sit in two places, the brand's and the vendor's, and an attack on either one exposes them. Customers rarely know which vendors hold their data, which is why breaches like this one can reach people who never dealt with the vendor directly. HIBP records the breach under Burger King Russia's name because that is whose customers were affected, even though the intrusion was at the platform.
The attack happened in August 2024 and the data surfaced in the press in October 2024, so some of what is exposed is now two years old. Phone numbers and email addresses change slowly, though, and for most people they are still current.
What this means for you
If you ordered from Burger King Russia through its app or site between 2018 and August 2024, assume your name, phone number and email address are in criminal hands. You can't take them back, so the useful moves are about stopping misuse: be sceptical of unexpected calls and texts, and protect the accounts that use the same phone number or email.
What to do if you were in it
- 1
Expect scam calls and texts that use your name
Phone numbers, names and birth dates were exposed. Don't share codes or card details with anyone who contacts you first, even if they mention Burger King or an order.
- 2
Treat unexpected loyalty or coupon messages as suspect
Phishing built on leaked customer lists often pretends to be a bonus or refund from the brand. Open the app or site yourself instead of following a link.
- 3
Add a PIN or extra check to your mobile account
A phone number plus a date of birth is what someone needs to try a SIM swap. Ask your carrier to require a PIN before any change to your number.
- 4
Secure the accounts tied to this email
Turn on two-factor authentication on your email and anything important. Use an authenticator app instead of text codes where you can.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It looks for your email and phone number in breach databases and on the dark web, and alerts you if they show up. Breach data can't be taken down, so the scan tells you what to change instead.
Frequently asked
Was I affected by the Burger King Russia data breach?
Search your email on Have I Been Pwned. If it lists Burger King Russia, your email was among the 3,155,792 unique addresses in the data.
What was exposed?
Names, email addresses, phone numbers, dates of birth, genders and approximate locations. Burger King Russia said payment and passport details were not included.
How did the breach happen?
Attackers hit the Mindbox marketing platform in August 2024. Burger King Russia's data was taken from there, according to HIBP and the company's own statement to the press.
Should I change my password?
Passwords weren't listed in the exposed data. Changing it isn't required, but turn on two-factor authentication if you haven't.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
