Pizza Hut Australia notified about 193,000 customers in September 2023 that an unauthorised third party had accessed a company database holding customer details and online order transaction records.
The chain said the exposed data included customer names, delivery addresses and delivery instructions, email addresses and contact numbers. For registered accounts, it said masked credit card data and one-way encrypted account passwords may also have been reached. Customers were advised to change their passwords and to stay alert for phishing attempts.
Chief executive Phil Reed said the company learned of the incident in early September, secured its systems, engaged forensic and cybersecurity specialists and began an investigation to establish what had occurred. Pizza Hut Australia said the Office of the Australian Information Commissioner had been fully informed.
Earlier in September, an actor associated with the ShinyHunters name claimed to have taken a Pizza Hut Australia database covering about 30 million order records through an unprotected Amazon Web Services endpoint, saying access ran from July into August 2023. The company never publicly confirmed whether those claims related to the breach it disclosed. Figures differed slightly between outlets: BleepingComputer reported 193,000 customers and The Register put the number at roughly 190,000.