Yum! Brands ransomware stole company data and closed 300 UK restaurants for a day

TechCrunch reported on 19 January 2023 that Yum! Brands — the parent company of KFC, Pizza Hut and Taco Bell — had confirmed company data was stolen in a ransomware attack. The Kentucky-based company said the attack impacted 'certain information technology systems' and prompted it to take some of its systems offline. TechCrunch had learned of an apparent incident affecting the company earlier that week, and Yum confirmed it in a Thursday statement.

The incident led to the closure of roughly 300 restaurants in the United Kingdom for 24 hours, the company said, and largely affected its UK operations. Yum said the unidentified intruder stole data from its network but that it had 'no evidence' customer data was taken; TechCrunch noted it was not clear whether the company had the technical means, such as logs, to determine what specific data was exfiltrated. It was also unclear when the attack began or how the systems were initially compromised — Yum spokesperson Rob Poetsch declined to provide details beyond the statement.

The company said that while the incident caused temporary disruption, it was aware of no other restaurant disruptions and did not expect the event to have a material adverse impact on its business, operations or financial results. Yum said it notified US federal law enforcement as its investigation continued.

About 300 UK restaurants closed for 24 hours; company data stolen from the network; some IT systems taken offline during the incident.

The initial compromise point and the date the attack began remained unclear even to disclosure, pointing to limited visibility into its own network.

Yum could not say whether it had the technical means, such as logs, to determine exactly what data had been exfiltrated.

Centralized corporate systems meant one attack forced both systems offline and hundreds of UK restaurants to close.

The intruder remained unidentified while data had already left the network.

A parent company's shared IT backbone concentrates risk: one intrusion can dark hundreds of restaurants across brands at once, and without adequate logging a victim cannot even say what was taken.

As of the 19 January 2023 statement, Yum had notified US federal law enforcement and its investigation was continuing; the intruder was unidentified and the company said it had no evidence of customer data theft. The roughly 300 UK restaurants had reopened after 24 hours, and Yum said it expected no material adverse impact on its business or financial results.