January 2023 Yum! Brands Data Breach Impacted Scores of Employees, Job Applicants, Class Action Says

New to ClassAction.org? Read our Newswire Disclaimer

Yum! Brands faces a proposed class action lawsuit in the wake of a massive data breach disclosed in January 2023 that compromised the sensitive information of a yet-unknown number of current and former employees and job applicants of the company’s stable of fast food restaurants. 

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 46-page complaint says that potentially hundreds of thousands of individuals are impacted by the Yum! Brands data breach, including, presumably, those who work/worked for and/or applied for jobs at KFC, Taco Bell, Pizza Hut and The Habit Burger Grill locations. 

The incident, sparked by a ransomware attack, was a direct result of Yum! Brands’ failure to implement adequate cybersecurity measures and its storage of sensitive data “in a reckless manner,” the suit alleges, calling the threat of a data breach a “known risk” to Yum! Brands. 

“Had Defendant properly monitored its computer networks, it would have discovered the intrusion promptly, and potentially been able to stop the intrusion or mitigate the injuries to Plaintiff(s) and the Class,” the case insists. 

Per the suit, Yum! Brands is purportedly the world’s largest restaurant company, with roughly 1,500 franchisees running more than 55,000 restaurants across 155 countries and territories. The filing relays that as of December 31, 2022, Yum! Brands employed approximately 23,000 people in the United States, with the majority of employees working at the company’s restaurants. 

According to the lawsuit, Yum! Brands disclosed in an annual report earlier this year that a ransomware attack impacted certain IT systems, causing the closure of “fewer than 300 restaurants” in the United Kingdom for a day while temporarily disrupting certain systems and resulting in data being stolen. Based on Yum! Brands’ description of the incident, the case says, it is unclear when the cyberattack actually occurred, though the defendant informed the Maine Attorney General that it experienced unauthorized access to its systems “on or around January 13, 2023.” 

“Although this summary attempts to downplay the severity of the Data Breach, Yum! Brands Data Breach was severe enough to force the closure of restaurants, and it admits that data was actually exfiltrated,” the lawsuit emphasizes. 

The plaintiff, a Kentucky-based former employee of Yum! Brands franchisee Charter Foods, claims to have received a notice, dated April 7, that revealed that the data breach included her name, address, date of birth and/or Social Security number.

Given the date of the notice sent to the plaintiff, proposed class members’ data was therefore in the hands of cybercriminals for at least three months before victims were notified of the incident, according to the case. 

“Yum! Brands was required to begin notifying victims of its Data Breach as soon as possible, informing them that their [personally identifiable information] had been stolen in a data breach affecting an unknown number of individuals,” the suit states. 

A Yum! Brands spokesperson told BleepingComputer.com that the company has found no evidence that customers were affected by the data breach. 

The lawsuit looks to cover all U.S. residents whose private information was maintained on Yum! Brands’ computer systems and who were sent a notice of the January 2023 data breach. 

Are you owed unclaimed settlement money? Check out our class action rebates page full of open class action settlements.