McDonalds 2025 Data Breach
Company · Fast food restaurant services · Franchise restaurant chain · Global
McDonald's Fast Food Chain Breach (Salesforce, 2025): 12 Million Customer Email & Home Address Records Exposed
Global fast food restaurant chain.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
44/100
Lower riskHigher risk
Moderate: notable exposure with meaningful misuse potential.
Data Sensitivity i
StandardExposed data is largely lower-sensitivity. Standard identity-protection precautions are advised.
12.2MRecords
2025Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
AddressPhysical address
Breach Summary
McDonald's customer data was exposed in a supply chain breach tied to the customer relationship management platform Salesforce. A threat group calling itself "Scattered LAPSUS$ Hunters" claimed responsibility and released a sample of the stolen database on October 3, 2025, announcing that the full dataset would follow on October 10. McDonald's was one of approximately 39 organizations listed on the group's dark web leak site. Salesforce attributed the compromise to vulnerabilities in customer-side integrations rather than its core platform. The breach affected 12.2 million records. The exposed data includes full names, email addresses, home and alternate phone numbers, and complete mailing addresses. Loyalty contact numbers linked to McDonald's rewards accounts were also present in the sample. This combination of contact and account data creates multiple avenues for abuse. Affected customers face elevated risk of phishing attempts, loyalty point theft, order fraud, and account takeover. McDonald's high brand recognition makes it particularly easy for attackers to craft convincing impersonation scams targeting these individuals. McDonald's has not issued detailed public statements about the scope of its exposure or its specific response to this incident. No regulatory actions or breach notifications have been publicly confirmed. Affected customers should treat any unsolicited contact referencing McDonald's with suspicion, monitor their loyalty accounts for unauthorized activity, and be alert to phishing emails or texts that use their personal details to appear legitimate.
Full threat analysis, exploitation vectors, and principal guidance below.
12 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
12.2M records analyzed
About McDonalds
McDonald's is the world's largest fast food restaurant chain by revenue and locations, operating more than 40,000 restaurants in over 100 countries through a franchise-heavy model. The company is headquartered in Chicago and publicly traded on the NYSE. Its business spans company-operated restaurants, franchisee licensing, supply chain, and a growing digital and loyalty platform.
Why They Hold Your Data
Global restaurant chains collect customer account data, loyalty records, contact details, order history, payment-adjacent information, and delivery activity across digital ordering systems.
Recent Developments
McDonald's has been investing significantly in its digital ordering and loyalty program infrastructure, with the MyMcDonald's Rewards platform accumulating hundreds of millions of registered users globally. The company has navigated menu price sensitivity and consumer pushback over inflation-era pricing. In 2025 it faced simultaneous scrutiny from the Scattered LAPSUS$ Hunters Salesforce campaign and a separate claimed breach of its India operations by the Everest ransomware group.
Data Points Exposed
3 verified field types
Email Address
Phone Number
Physical address High
Breach Impact
McDonald's was among the approximately 39 organizations listed on the Scattered LAPSUS$ Hunters dark web leak site in October 2025, with customer contact data including email addresses, phone numbers, and home addresses published as part of the campaign. The company has not made detailed public statements about its specific response to or scope of exposure in this campaign. Salesforce attributed the campaign to customer-side integration vulnerabilities rather than a compromise of its core platform.
Exploitation & Downstream Threats
• SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure
Principal Risk Advisory
What this means for a principal
A consumer-service breach: contact and account data supports phishing, account takeover and profile enrichment. For a high-profile principal this is targeting-grade, not merely identity-theft-grade: the combination lets an adversary locate, impersonate, or pressure the principal with little additional work.
What You Should Do
- Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
SL
Threat Actor: Scattered Lapsus$ HuntersConfidence: Medium-High
Motivation: Financial, notoriety, extortion
A 2025 claimed fusion of Scattered Spider, LAPSUS$, and ShinyHunters branding. It used Telegram and forum channels for threats, leak theatrics, and extortion pressure.
This breach is linked to the ShinyHunters / Scattered Lapsus$ Hunters - Salesforce (2025-26) campaign. See the full campaign analysis →
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation