Breach Report: Yum! Brands (KFC, Taco Bell, Pizza Hut) ransomware attack shuts down almost 300 locations, affects unknown total

Updated 5/3/2023: included class-action lawsuit and franchisee information

One-sentence summary:

Yum! Brands (KFC, Taco Bell, Pizza Hut) January 2023 ransomware attack potentially breaches employees’ data and briefly shuts down 300 locations, results in a class-action lawsuit.

Who was involved?

Yum! Brands, Inc., parent of KFC, Pizza Hut, Taco Bell, and Habit Burger Grill, Charter Foods, at least 109,194 Charter Foods employees, and a threat actor.

What was the timeline?

January 13, 2023: Yum! Brands is hit with a ransomware attack

January 18, 2023: Yum! Brands announces the ransomware attack

March 9, 2023: Yum! Brands discovers the breach

April 7, 2023: Yum! Brands begins victim notification

April 14, 2023: Yum! Brands is sued in federal court in Kentucky via a class-action lawsuit

What occurred?

Yum! Brands suffered a ransomware attack in January 2023, leading to the potential breach of employees’ personal information, including “Driver’s License Number or Non-Driver Identification Card Number” (Gatlan, 2023; Kim, 2023). Almost 300 UK-based restaurants were affected (Gatlan, 2023; Yum! Brands, 2023a, p. 13). A federal, class-action lawsuit has been filed in Kentucky against Yum! Brands (Stinson v. Yum! Brands, Inc., 2023). A franchisee, Charter Foods, was also involved in the breach, and a separate class-action lawsuit has been filed against it as well.

Estimated costs:

Associated incident response costs, breach notification costs, “leading digital forensics and restoration teams,” operational and lost business costs (“fewer than 300 restaurants shut down in one market for one day”), 2 years IDX identity services with $1 mil. insurance policy, M-F call center

Involved laws:

State: Maine: 10 M.R.S.A. § 1346

Root cause:

TBA or N/A (see disclaimer)

Lessons learned:

TBA or N/A (see disclaimer)

Sources:

Gatlan, S. (2023, April 10). KFC, Pizza Hut owner discloses data breach after ransomware attack. BleepingComputer. https://www.bleepingcomputer.com/news/security/kfc-pizza-hut-owner-discloses-data-breach-after-ransomware-attack/

Kim, A. (2023). Data Breach Notifications. In Privacy, Identity Theft and Data Security Breaches. Office of the Maine Attorney General. Retrieved April 12, 2023, from https://apps.web.maine.gov/online/aeviewer/ME/40/b85bfcfb-4ff7-419e-8dd2-95e8f41a5ad1.shtml

Stinson v. Yum! Brands, Inc., Case No. 3:23-cv-00183-DJH (W.D. Ken. 2023). https://www.classaction.org/media/stinson-v-yum-brands-inc.pdf

Yum! Brands. (2023a). YUM! BRANDS 2022 ANNUAL REPORT: UNLOCKING OPPORTUNITY FOR GOOD GROWTH. In EDGAR | Company Filings. U.S. Securities and Exchange Commission. Retrieved April 12, 2023, from https://www.sec.gov/Archives/edgar/data/1041061/000119312523095287/d535046dars.pdf

Yum! Brands. (2023b). Yum Notification Letter.pdf. In Data Breach Notifications. Office of the Maine Attorney General. Retrieved April 12, 2023, from https://apps.web.maine.gov/online/aeviewer/ME/40/b85bfcfb-4ff7-419e-8dd2-95e8f41a5ad1/32f8fb7d-87b2-43ba-a5fd-a7b95e3872e2/document.html

Yum! Brands Inc. (WUKY). (2017, November 2). untitled. wuky.org. https://www.wuky.org/local-regional-news/2017-11-02/yum-brands-report-major-profit-growth

About Post Author

Kyler Kent CISSP

Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike’s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation—turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master’s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect – Professional, AWS Security – Specialty, and multiple CrowdStrike credentials. He writes to close the gap between “what the textbook says” and what analysts actually do on shift with his published book: "SOC Analyst Career Guide" (ISBN-13: 9781835467466). https://linktr.ee/kentprotect.com Corrections: [email protected]

http://kylerkent.com