Yum! Brands
Disclosed Jan 18, 20233 years agoConfirmed
Ransomware attack on KFC and Pizza Hut owner closes UK restaurants and exposes ID data
Yum! Brands announced on January 18, 2023 a ransomware attack that hit some IT systems and closed fewer than 300 restaurants in the UK for a day. It later notified individuals that stolen files included their names and driver's license or other ID numbers, saying it had no indication customer data was affected.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Jan 18, 2023 |
| Discovered | Jan 13, 2023 |
| Happened | Jan 13, 2023 |
| Attack | Ransomware |
| Data exposed | Names, Government IDs |
| Sector | Retail · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Yum! Brandsoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Yum! Brandsatg.wa.gov · Official notice | Official notice |
| Notice letter filed with the Delaware DOJ: YUM! Brandsattorneygeneral.delaware.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Yum! Brandsjustice.oregon.gov · Official notice | Official notice |
| California AG data breach notice: Yum! Brands, Inc.oag.ca.gov · Regulator | Regulator |
| KFC, Pizza Hut owner discloses data breach after ransomware attackbleepingcomputer.com · News | News |
| Yum! Brands Form 8-K, January 19, 2023sec.gov · SEC filing | SEC filing |
| Indiana Attorney General 2023 data breach report: Yum! Brandsin.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Jan 18, 2023 | |
| Washington AGresidents of WA | Apr 7, 2023 | 1,220 |
| California AGresidents of CA | Apr 13, 2023 | |
| Delaware DOJresidents of DE | Apr 14, 2023 | 578 |
| Oregon DOJresidents of OR | Apr 14, 2023 | 300,000 |
| Indiana AGresidents of IN | Apr 14, 2023 | 15,406 |
History of this record
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/D-BYear-to-Date-Report-2023.pdf · backfill source
- 2026-09-25 · data_types: ["names"] to ["names","government-id"] · seed source
- 2026-09-25 · disclosed: 2023-04-07 to 2023-01-18 · seed source
- 2026-09-25 · summary: empty to Yum! Brands announced on January 18, 2023 a ransomware attack that hit some IT systems and closed fewer than 300 restaurants in the UK for a day. It later notified individuals that stolen files included their names and driver's license or o · seed source
- 2026-09-25 · title: empty to Ransomware attack on KFC and Pizza Hut owner closes UK restaurants and exposes ID data · seed source
- 2026-09-25 · data_types: [] to ["names"] · backfill source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · disclosed: 2023-04-13 to 2023-04-07 · backfill source
- 2026-09-25 · discovered: empty to 2023-01-13 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.