An unknown number of personal details about McDonald's customers was exposed after hackers broke into the database of a partner of the burger giant.
Miscreants may have made off with email, contact information and birthdates as a result of the breach.
Fans of the fast food franchise supplied the information when they signed up for online promotions or newsletter subscriptions. Financial information or Social Security numbers wasn't requested during these requests and not stored on the compromised database, maintained by a third-party supplier.
The data was held by an unmanned email database management firm hired by Arc Worldwide, a McDonald's business partner. McDonald's failed to reveal the number of records involved or the timing of the the breach, only saying it was working with its business partners and law enforcement to clean up the resulting mess.
Paul Vlissidis, technical director at NGS Secure (the security testing division of NCC Group), said the breach showed that third-party suppliers can be the weak leak in information security.
"Nowadays, third party suppliers often have access to company networks – sometimes to quite a high level," Vlissidis said. "It’s an old adage that security is only as good as the weakest link, and in cases like this the supply chain may be that weak spot.
"We advise all our customers to ensure that all their third party suppliers undergo rigorous and regular security testing before they are allowed to access the customer’s network or even handle their customer data." ®