KFC Venezuela Suffers Alleged Data Breach Exposing 1 Million Customer Records

A threat actor is claiming responsibility for a data breach at KFC Venezuela’s operations, offering for sale a database containing the personal and order information of more than one million customers. The sale was advertised on a dark web forum on 8 October 2025, where the seller posted a 405 MB CSV file containing exactly 1,067,291 rows of data.

The breached database allegedly includes personally identifiable information such as full names, phone numbers, and email addresses, with complete delivery addresses also part of the leak, alongside payment method data, exchange rate information used in transactions, and full records of ordered items with quantities and unit prices.

The data set supposedly exposes operational markers like order creation and update timestamps, sales channel identifiers, and internal store codes, implying access to KFC Venezuela’s order management or CRM systems. According to CSN, the combination of personal and financial details could enable targeted phishing and other scams, and KFC Venezuela had not issued an official statement about the alleged breach at the time of writing. Customers are advised to monitor statements and consider password changes and multi-factor authentication where available.