Hackers claim to have stolen data of 1 million customers of Pizza Hut Australia
Learn More
Pizza Hut Australia has fallen victim to a data breach affecting over one million customers. The breach is claimed by the hacking group ShinyHunters.
The breach allegedly occurred between one to two months ago when ShinyHunters gained unauthorized access through Amazon Web Services (AWS), utilizing multiple entry points. The hackers assert to have stolen more than 30 million records, which encompassed customers' order details and personal information of more than one million individuals.
Of particular concern is ShinyHunters' assertion that their activities remained undetected throughout the duration of the attack.
To substantiate their claims, ShinyHunters provided two sample files:
- The first file contained 200,000 order records with detailed information on orders,
- The second was a JSON file featuring data on 100,000 customers.
This data included
- customer names,
- email addresses,
- postal addresses,
- geographical coordinates,
- mobile phone numbers,
- passwords,
- service preferences (delivery or pickup),
- encrypted credit card numbers.
Notably, while the credit card information was encrypted, other fields were left in plaintext.
Upon inspecting the files researchers have been able to confirm that there are real individuals with matching names within the appropriate geographic regions for the provided data samples.
ShinyHunters has made a demand of $300,000 for the complete deletion of the stolen data. ShinyHunters has a track record of selling or leaking data when their extortion demands go unmet. Thus far, Pizza Hut has not issued any response to their demands.
It's worth noting that Pizza Hut Australia's website currently lacks any notifications to customers regarding a data security incident involving their credit card information and no public notice regarding the security breach.
Update - Pizza Hut's Australian operations confirmed the breach in an email to customers, revealing that the company detected unauthorized access in early September. Approximately 193,000 customers are believed to be impacted, and affected customers have been notified. The incident did not disrupt Pizza Hut's operations.
