Burger King Uses DMCA to Remove Blog Exposing Drive-Thru System Security Flaws

Burger King has invoked the Digital Millennium Copyright Act to force the removal of a security researcher’s blog post that disclosed serious vulnerabilities in its drive-thru “Assistant” system, with ethical hacker BobDaHacker’s report showing how attackers could bypass authentication, listen in on customer orders, and access employee records before the takedown.

On Saturday, the researcher published a post titled “We Hacked Burger King” detailing weaknesses in the still-in-beta Assistant platform built on AWS Cognito, including a sign-up flow that could deliver a plaintext password by email. RBI promptly patched the vulnerabilities the same day, and the researcher confirms no customer data was retained and responsible disclosure protocols were followed, though threat intelligence firm Cyble sent a DMCA notice alleging unauthorized use of the Burger King trademark.

The blog had been live for less than 48 hours before the content was taken down; an archived copy remains online, and cybersecurity professionals have reposted the findings to highlight the Streisand effect. According to Information Security Media Group, a Burger King spokesperson said the test platform does not store customer data long-term and only retains aggregated information for a few weeks.