Yum! Brands

Disclosed Jan 18, 2023Confirmed

Ransomware attack on KFC and Pizza Hut owner closes UK restaurants and exposes ID data

Yum! Brands announced on January 18, 2023 a ransomware attack that hit some IT systems and closed fewer than 300 restaurants in the UK for a day. It later notified individuals that stolen files included their names and driver's license or other ID numbers, saying it had no indication customer data was affected.

What is known

People affected	Not stated in the sources we have
Disclosed	Jan 18, 2023
Discovered	Jan 13, 2023
Happened	Jan 13, 2023
Attack	Ransomware
Data exposed	NamesGovernment IDs
Sector	Retail · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Yum! Brands

Official noticeatg.wa.gov

Washington Attorney General breach notice: Yum! Brands

Official noticeattorneygeneral.delaware.gov

Notice letter filed with the Delaware DOJ: YUM! Brands

Official noticejustice.oregon.gov

Oregon DOJ breach notice: Yum! Brands

Regulatoroag.ca.gov

California AG data breach notice: Yum! Brands, Inc.

Newsbleepingcomputer.com

KFC, Pizza Hut owner discloses data breach after ransomware attack

SEC filingsec.gov

Yum! Brands Form 8-K, January 19, 2023

Official noticein.gov

Indiana Attorney General 2023 data breach report: Yum! Brands

Notices filed

TotalJan 18, 2023

ResearchCount not stated

Residents of WAApr 7, 2023

Washington AG1,220 people

Residents of CAApr 13, 2023

California AGCount not stated

Residents of DEApr 14, 2023

Delaware DOJ578 people

Residents of ORApr 14, 2023

Oregon DOJ300,000 people

Residents of INApr 14, 2023

Indiana AG15,406 people

History of this record

source2026-09-25

empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/D-BYear-to-Date-Report-2023.pdfby backfillSource

data_types2026-09-25

["names"] to ["names","government-id"]by seedSource

disclosed2026-09-25

2023-04-07 to 2023-01-18by seedSource

summary2026-09-25

empty to Yum! Brands announced on January 18, 2023 a ransomware attack that hit some IT systems and closed fewer than 300 restaurants in the UK for a day. It later notified individuals that stolen files included their names and driver's license or oby seedSource

title2026-09-25

empty to Ransomware attack on KFC and Pizza Hut owner closes UK restaurants and exposes ID databy seedSource

data_types2026-09-25

[] to ["names"]by backfillSource

attack2026-09-25

unknown to ransomwareby backfillSource

disclosed2026-09-25

2023-04-13 to 2023-04-07by backfillSource

discovered2026-09-25

empty to 2023-01-13by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Yum! Brands