Burger King Serves Up Sensitive Data, No Mayo
The incident marks the second time since 2019 that a misconfiguration could have let threat actors "have it their way" when it comes to BK's data.
A misconfiguration in the site for Burger King France has exposed sensitive data that could have been used to launch a whopper of a cyberattack against the chain.
Researchers at Cybernews found the flaw and noted that a similar 2019 misconfiguration had leaked information on kids who bought Burger King menus.
The most recent Burger King data leak incident exposed database credentials, and what researchers think are job posts and applicant data. The analysts weren't legally able to view the contents of the database, the report noted.
By combining the compromised credentials with the site's Google Tag Manager ID, threat actors could have changed the Tag ID to a container they control, and from there execute arbitrary code, the Security Affairs team explained. The researchers also discovered a Google Analytics ID among the exposed data, which could have been used to manipulate the site's analytics.
The researchers alerted Burger King to the potential for cyberattacks stemming from the data exposure, and the problem has been fixed.
About the Author
You May Also Like
Cybersecurity Day: How to Automate Security Analytics with AI and ML
Dec 17, 2024The Dirt on ROT Data
Dec 18, 2024