Hackers Steal Customer Information In McDonald’s Cyberattack

Hackers obtained customer data from McDonald’s after breaching the company’s systems in the U.S., South Korea and Taiwan, according to The Wall Street Journal.

U.S. employees’ and franchisees’ contact information, seating capacity of U.S. locations and the dimensions of play areas at restaurants in the U.S were all exposed during the breach, McDonald’s said Friday, The Wall Street Journal reported. While McDonald’s said the hack didn’t cause disruptions at any of its locations, it vowed to launch an investigation into the breach and continue to invest in bolstering its cybersecurity protocol.

“McDonald’s will leverage the findings from the investigation as well as input from security resources to identify ways to further enhance our existing security measures,” the global fast-food chain told U.S. employees in an internal message, according to the WSJ.

McDonald’s customer data — including emails, phone numbers, and addresses — was obtained in South Korea and Taiwan, the WSJ reported. Hackers also accessed McDonald’s employee information in Taiwan as they did in the U.S.

The cybercriminals didn’t obtain any customer payment information, the company said, according to the WSJ. McDonald’s didn’t say how many total customers and employees were affected by the breach.

Investigators hired after McDonald’s noticed unauthorized activity on its systems discovered the cyberattack, the WSJ reported. The breach didn’t involve ransomware and McDonald’s was never asked to pay a ransom.

The hack is the latest in a string of cyberattacks targeting major U.S. companies. Colonial Pipeline, a major U.S. gasoline provider, and JBS USA, the world’s largest meat supplier, both made hefty ransom payments to cybercriminals after they were hacked with ransomware.

But the Department of Justice and FBI announced Monday that most of the ransom paid by Colonial Pipeline had been recovered and returned to the company.

“We will continue to target the entire ransomware ecosystem to disrupt and deter these attacks,” Deputy Attorney General Lisa O. Monaco said during a press conference Monday. “Today’s announcements also demonstrate the value of early notification to law enforcement.”