Pizza Hut pizzahut.com Pizza Hut data breach 2017: what happened and what to do
An unauthorized party got into Pizza Hut's website for about 28 hours, from October 1 to 2, 2017. Customers who ordered online in that window may have had their name, address, email and payment card details exposed. Press reports put it at roughly 60,000 customers.
View all 13,115 breaches- Breach date
- Oct 2017
- Made public
- 14 Oct 2017
- Data exposed
- Names, Email addresses, Physical addresses, Credit cards
- Last updated
What happened
Pizza Hut told customers on October 14, 2017 that an unauthorized party had intruded on its website. The window ran from the morning of October 1 to midday on October 2, 2017, about 28 hours. Anyone who ordered online during that time may have been affected.
Per the notice, the exposed details were name, billing zip code, delivery address, email address and payment card information: the card number, expiry date and CVV. Pizza Hut said less than 1% of visits to its website that week were affected. Press reports converted that into roughly 60,000 customers, and say the company offered them a year of free credit monitoring through Kroll.
The notice came about two weeks after the intrusion, and some customers reported fraudulent charges before it arrived. A name, address and email together are also useful for phishing that looks like a pizza order problem or a refund.
Because card numbers and CVVs leaked, the fix is a new card, not a new password. Check statements from October 2017 if you still have them, and be careful with any message that mentions Pizza Hut and asks you to confirm payment details.
What to do if you were in it
- 1
Check your card statements
Look at every charge from the affected period and report anything you don't recognize to your bank. Most card issuers cap your liability for fraud if you report it quickly.
- 2
Ask for a new card if you used one
If you paid with a card during the affected window, ask your issuer to replace it. Card numbers, expiry dates and security codes can't be changed any other way.
- 3
Turn on transaction alerts
Set up text or app alerts for every purchase so fraud shows up in minutes, not on next month's statement.
- 4
Expect phishing that mentions the breach
Emails and texts that offer help with the breach are a common scam. Go to the company's website yourself instead of clicking links.
- 5
Check whether your email or phone is in other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details appear in a new leak.
Frequently asked
Was I affected by the Pizza Hut data breach?
Only if you ordered on Pizza Hut's website between the morning of October 1 and midday on October 2, 2017.
What was exposed?
Name, billing zip code, delivery address, email address and payment card details including the CVV, according to Pizza Hut's notice.
Should I change my password?
Passwords weren't listed in the notice. Replace the payment card you used instead.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
