Subway online ordering system exposes customer data
It was found that changing a number in a URL in Subway's online ordering system allowed other customers' contact details and order histories to be viewed without any authentication. The Personal Information Protection Commission (PIPC) launched an investigation into how the leak happened and its scale. Subway said the suspension of online ordering was unrelated to the personal data leak.
Key facts
- Affected organisation
- Subway
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- Customer contact details and order histories exposed; scale unconfirmed
- Cause / method
- Other customers' data could be viewed without authentication simply by changing a number in the URL
- Location
- South Korea
If your data was exposed
Exposed dataPhone numberUsage & purchase history
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
- If you’ve suffered harm, report it. Call 118 (no area code) for privacy violations, contact the police for financial losses, and apply for dispute mediation to seek compensation.Personal Information Infringement Report Centre ↗Korean National Police Agency cybercrime report ↗Personal Information Dispute Mediation Committee ↗
Timeline
- Signs of personal data exposure at Subway came to light.
- The Personal Information Protection Commission (PIPC) launched an investigation, and Subway said the suspension of online ordering was unrelated to the personal data leak.
4 related reports
Other incidents at Subway
LockBit claims ransomware attack on sandwich chain Subway
Ransomware group LockBit claimed to have attacked sandwich chain Subway. The specific extent of the damage and any confirmation or response from Subway have not been confirmed.
Related reports: 3 · last report →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.