Wendy's wendys.com.ph Wendy's Philippines data breach: what happened and what to do
In 2018, the Philippine franchise of Wendy's lost a database of about 52,000 customers and job applicants. It included names, email and physical addresses, phone numbers, IP addresses and passwords stored as MD5 hashes. This is not the US company.
View all 13,115 breaches- Breach date
- 31 Mar 2018
- Affected
- 52,485
- Data exposed
- Education levels, Email addresses, IP addresses, Job applications, Names, Passwords, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
This breach involves Wendy's in the Philippines, not the US restaurant chain. In March 2018, the franchise's website database was breached. Have I Been Pwned lists 52,485 customers and job applicants in the data.
The Philippines' National Privacy Commission looked into the leak in the weeks after it came to light. ABS-CBN reported that the regulator ordered the franchise operator to tell the people affected. The regulator's own estimate of exposed records was higher than the Have I Been Pwned count, so you may see larger figures in older news coverage.
What was exposed
According to Have I Been Pwned, the data included names, email addresses, IP addresses, physical addresses, phone numbers, education levels, job applications and passwords stored as MD5 hashes. MD5 is an old, fast hashing method, and simple passwords hashed this way can often be recovered.
Job applications matter here. A record that links your name, address, phone number and education history is useful for targeted phishing, such as a fake recruiter or a fake delivery message that quotes real details.
What to do
If you ever had an account with Wendy's Philippines or applied for a job there, assume your password and contact details are out. Change that password anywhere you reused it, and treat unexpected messages that mention your application or your order with suspicion.
What to do if you were in it
- 1
Change the password, and every reuse of it
Change it on the affected service if you still have an account, then on every other account that used the same or a similar password. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey where you can. It blocks most account takeovers even when a password is already out there.
- 3
Expect phishing that uses these details
Messages that quote your name, address or a job application can look real. Don't click links in them. Go to the company's site yourself.
- 4
Check whether your email or phone is in this and other breaches
A free Serus scan checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak. It can't remove breach data, so the steps above are what protect you.
Frequently asked
Is this the US Wendy's?
No. The breach affected the franchise in the Philippines. Have I Been Pwned lists the domain wendys.com.ph.
What was exposed?
Names, email and IP addresses, physical addresses, phone numbers, education levels, job applications and passwords stored as MD5 hashes, according to Have I Been Pwned.
Should I change my password?
Yes, if you had an account there. Change it on every site where you used the same password, and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
