Privacy body probes fastfood chain over data breach

MANILA, Philippines — Personal data of over 82,000 Filipinos have been compromised following a data breach involving a fastfood chain, according to the National Privacy Commission (NPC). 

In a two-page order dated May 2, the privacy body directed Wendy’s Philippines to notify all affected data subjects of the breach, which occurred last April 23. 

It also ordered Wendy’s to explain why no further action should be taken against the company over its failure to comply with existing data privacy rules, which requires organizations affected by a breach to inform data subjects of the incident within 72 hours. 

A database of Wendy’s Philippines containing personal details of data subjects, according to NPC, was released online on April 23. 

Data included names, contact numbers, home addresses, hashed passwords, transaction details and mode of payment of the company’s customers, loyalty card members and job applicants.   

The NPC was informed of the incident three days later. 

“On an analysis of information exfiltrated, it can be ascertained that the exposure of certain personal sensitive information or financial information within the database puts the affected data subjects in harm’s way,” the order read. 

“There is a real risk of serious harm to the affected data subjects; the data is not merely incidental to the breach,” it added. 

In addition to informing those affected by the breach, the NPC also directed Wendy’s to provide the commission of its website’s server, network and traffic logs prior to the breach. 

It also directed the company to submit its privacy policy at the time of the breach, an update on its internal investigation of the incident and its policy on transactional procedures. 

Wendy’s Philippines has yet to comment on the directive of the privacy body.