KFC, Pizza Hut owner employee data stolen in ransomware attack

Upon learning that attackers accessed and siphoned data in January, Yum! Brands, the fast-food chain operator behind The Habit Burger Grill, KFC, Pizza Hut, and Taco Bell, has begun sending Notice of Security Breach letters to employees whose data were potentially affected.

“We are writing to provide you with information about a cybersecurity incident involving your personal information that occurred mid-January 2023,” says the breach notice. While the company finds “no evidence of identity theft or fraud” involving the stolen data, it says it is contacting employees “out of an abundance of caution” to provide support and resources they might need.

The notice revealed that employee names, driver’s license numbers, and other ID card numbers are among the data that ransomware attackers took.

According to BleepingComputer, Yum! Brands has yet to provide the number of employees whose data threat actors stole during the attack.

The January ransomware attack

Over three months ago, Yum! Brands said it had experienced a ransomware attack that affected its IT systems, forcing it to close less than 300 restaurant chains in the UK for a day.

“Promptly upon detection of the incident, the Company initiated response protocols, including deploying containment measures such as taking certain systems offline and implementing enhanced monitoring technology,” the company said in a statement. “The Company also initiated an investigation, engaged the services of industry-leading cybersecurity and forensics professionals, and notified Federal law enforcement.”

In its filing with the Securities and Exchange Commission (SEC) in January, Yum! Brands assured investors that although the attack caused a temporary disruption, there would be no negative financial impact.

“While this incident caused temporary disruption, the Company is aware of no other restaurant disruptions and does not expect this event to have a material adverse impact on its business, operations or financial results,” the Form 8-K mentioned.

“…no material adverse effect…”

Yum! Brands continues to believe the ransomware incident would not cause adverse operational or financial effects in the long run.

“While the Company’s response to this incident is ongoing, at this time we do not believe such impact of the incident will ultimately have a material adverse effect on our business, results of operations or financial condition,” the company says in its 2022 annual report to the SEC which it filed on Friday.

The firm has yet to disclose the ransomware group behind the attack.