Actor claims leak of 14,696 McDonald's Indonesia employee records
A threat actor published on a hacker forum a dataset they attribute to McDonald's Indonesia: 14,696 employee records and 261 restaurant records, allegedly obtained through a flaw in a work-scheduling application. DailyDarkWeb assesses the forum post appears to date from January 2026 and the actor dates the breach to October 2025, so it may be recirculated data; McDonald's Indonesia has not confirmed an incident. If genuine, the personal data raises the risk of targeted phishing and identity theft against employees.
What happened
A threat actor posted on a hacker forum a dataset they claim belongs to McDonald's Indonesia, with 14,696 employee records and 261 restaurant records. The actor says the data came from a flaw in a work-scheduling application. McDonald's Indonesia has not confirmed an incident.
Why it matters
The claimed data includes full names, job titles, dates of birth, hire and termination dates, phone numbers and home addresses of employees. If genuine, it raises the risk of targeted scams and identity theft against these people. It is an unverified and possibly recirculated claim, with no confirmation from the company.
What to do
Named employees should watch for contacts that use their personal details. Check whether corporate data or credentials appear in the posted set and monitor for scam attempts. Treat as unconfirmed until McDonald's Indonesia officially responds.
For the technical team
- Affected
- McDonald's Indonesia; dados alegadamente obtidos por falha em aplicativo de escalas de trabalho · Unidentified work-scheduling application; dataset attributed to McDonald's Indonesia (14,696 employee records and 261 restaurant records) solely on the actor's word.
- Exploitation
- Claim by a threat actor on a hacker forum, reported by DailyDarkWeb. No confirmation from the victim; DailyDarkWeb classifies it as an unverified claim and notes the post appears to date from January 2026, with the actor dating the breach to October 2025, possibly recirculated data.
- Fix
- Not applicable (data leak); sources cite no fix.
- Vector
- Alleged flaw in a work-scheduling application, per the actor. Technical details of the flaw and access vector were not disclosed in the sources.
- More details
- Claimed data: employee IDs, restaurant IDs, full names, job titles, dates of birth, hire and termination dates, phone numbers and home addresses. DailyDarkWeb highlights risk of targeted phishing and identity theft against employees if the data is genuine. No technical IOCs cited.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
