The incident marks the second time since 2019 that a misconfiguration could have let threat actors “have it their way” when it comes to BK’s data.
A misconfiguration in the site for Burger King France has exposed sensitive data that could have been used to launch a whopper of a cyberattack against the chain.
Researchers at Security Affairs found the flaw and noted that a similar 2019 misconfiguration had leaked information on kids who bought Burger King menus.
The most recent Burger King data leak incident exposed database credentials, and what researchers think are job posts and applicant data. The analysts weren’t legally able to view the contents of the database, the report noted.
By combining the compromised credentials with the site’s Google Tag Manager ID, threat actors could have changed the Tag ID to a container they control, and from there execute arbitrary code, the Security Affairs team explained. The researchers also discovered a Google Analytics ID among the exposed data, which could have been used to manipulate the site’s analytics.
The researchers alerted Burger King to the potential for cyberattacks stemming from the data exposure, and the problem has been fixed.
