Popeyes, Tim Hortons, Burger King platforms have “catastrophic” vulnerabilities, say hackers

Popeyes, Tim Hortons, and Burger King platforms operated by Restaurant Brands International have “catastrophic” vulnerabilities, according to Malwarebytes. Two ethical hackers uncovered flaws that could allow an attacker to access voice recordings, add or remove franchise stores, view and edit employee accounts, and access store analytics and sales data, among other impacts.

The researchers reported that RBI uses AWS Cognito but forgot to turn off user signups, meaning self-registration could occur; they also found a signup endpoint that bypassed email verification, resulting in a password being sent in plain text. They identified three assistant platforms (domains bk[.]com, popeyes[.]com, and timhortons[.]com) as vulnerable. RBI fixed the issues on the same day, but reportedly did so without acknowledging the researchers or commenting on the vulnerabilities.

RBI is one of the world’s largest quick service restaurant companies, formed in 2014 through a $12.5 billion merger of Burger King and Tim Hortons, and it now operates over 32,000 restaurants in more than 120 countries and territories.