Breach Report: Charter Foods breach affects 109,000, class-action lawsuit filed

One-sentence summary:

Charter Foods, a Yum! Brands franchisee, was breached in a January 2023 ransomware attack affecting 109,000 employees and resulting in a class-action lawsuit.

Who was involved?

Charter Foods, Inc., Charter Foods North, LLC, Yum! Brands (KFC, Taco Bell, Pizza Hut), 109,194 employees, and a threat actor.

What was the timeline?

January 13, 2023: Yum! Brands, parent company, is hit with a ransomware attack and includes Charter Foods

April 7, 2023: Charter Foods files notice of breach with the Maine OAG and begins employee notification

April 17, 2023: Charter Foods is sued in federal court in Tennessee

What occurred?

Charter Foods, a Yum! Brands franchisee, was affected by a January 2023 ransomware attack on Yum! Brands. Over 109,194 employees are implicated, and the potentially breached data included: “name, address, date of birth, and/or social security number” (Biesecker, 2023; Charter Foods, 2023, p. 1). Subsequently, Charter Foods was sued in federal court in Tennessee over the breach (Maguire-Hapgood v. Charter Foods North, LLC, et al., 2023).

Estimated costs:

Incident response costs, breach notification costs, litigation defense costs, 12 months of identity services from TransUnion

Involved laws:

Federal: The Federal Trade Commission Act (the “FTC Act”) (15 U.S.C. § 45) (Maguire-Hapgood v. Charter Foods North, LLC, et al., 2023, p. 13)

State: Maine: 10 M.R.S.A. § 1346

Tennessee: Tenn. Code § 47-18-2107

Root cause:

TBA or N/A (see disclaimer)

Lessons learned:

TBA or N/A (see disclaimer)

Sources:

Biesecker, J. (2023). Data Breach Notifications. In Privacy, Identity Theft and Data Security Breaches. Office of the Maine Attorney General. Retrieved May 3, 2023, from https://apps.web.maine.gov/online/aeviewer/ME/40/5da67cb4-82fd-447e-b7a6-d7b0174fd326.shtml

Charter Foods. (2023). Charter Foods_individual notice.pdf. In Data Breach Notifications (No. 000010102G0400). Office of the Maine Attorney General. Retrieved May 3, 2023, from https://apps.web.maine.gov/online/aeviewer/ME/40/5da67cb4-82fd-447e-b7a6-d7b0174fd326/baa2cdbc-6bc3-4594-b0fc-f07f37760eaf/document.html

Charter Foods (jobappnetwork). (n.d.). untitled. jobappnetwork.com. https://marketing-assets.jobappnetwork.com/11147/dea0a770-4ac7-11eb-bb72-056c22ec1496

Maguire-Hapgood v. Charter Foods North, LLC, et al., Case No. 2:23-cv-00040 (E.D. Tenn. 2023). https://www.classaction.org/media/maguire-hapgood-v-charter-foods-north-llc-et-al.pdf

Mehorter, K. (2023, April 19). Class Action Filed Over Charter Foods January 2023 Data Breach. ClassAction.org. https://www.classaction.org/news/class-action-filed-over-charter-foods-january-2023-data-breach#embedded-document

About Post Author

Kyler Kent CISSP

Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike’s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation—turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master’s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect – Professional, AWS Security – Specialty, and multiple CrowdStrike credentials. He writes to close the gap between “what the textbook says” and what analysts actually do on shift with his published book: "SOC Analyst Career Guide" (ISBN-13: 9781835467466). https://linktr.ee/kentprotect.com Corrections: [email protected]

http://kylerkent.com