McDonald’s India asks users to update app after data leak report
Security

McDonald’s India asks users to update app after data leak report

McDonald’s India operation asked users to update their McDelivery app as a 'precautionary measure' after a security firm said it had found that it was leaking personal data of over 2.2 million users.

The Indian operation of the food chain, which is owned and managed by franchisees, said in posts on Facebook and Twitter over the weekend that its website and app do not store any sensitive financial data of users.

The operation did not admit or deny that there had been a breach, but urged users to update the online ordering app as a precautionary measure. “The website and app has always been safe to use, and we update security measure on regular basis,” according to the post.

Security firm Fallible claimed in a post Friday that the app is leaking personal data for more than 2.2 million of its users, which include their name, email address, phone number, home address and coordinates and social profile links.

It said it had contacted McDelivery with the issue on Feb 7 and received an acknowledgement from a senior IT manager on Feb 13, but there hadn’t been information about a fix from the company even after 33 days.

Fallible said “an unprotected publicly accessible API endpoint for getting user details coupled with serially enumerable integers as customer IDs can be used to obtain access to all users personal information.”

In an update, Fallible said McDonald's India had replied to the firm that they have fixed the issue and would be releasing an official statement asking users to upgrade the app, but in another update the security firm claimed that the fix was incomplete and the endpoint is still leaking data.

McDonald’s did not immediately comment over the weekend.

A user of the app, Srinivas Kodali wrote in a Twitter message that he had filed a complaint with police in Hyderabad in South India against McDonald’s under Section 43A of the country's Information Technology Act, which makes companies liable to pay damages for the compromise of sensitive personal data as a result of their failure in implementing and maintaining reasonable security practices.

IDG Insider

PREVIOUS ARTICLE

«Japan looks beyond Industry 4.0 towards Society 5.0

NEXT ARTICLE

BlackBerry readies a more secure version of the Samsung Galaxy S7»
author_image
IDG Connect

IDG Connect tackles the tech stories that matter to you

Add Your Comment

Recommended for You

silhouette

Everything you need to know about… Tech Careers

IDG Connect tackles the tech stories that matter to you

kathryn-cave

Blockchain For Dummies: What you really need to know

Kathryn Cave looks at the big trends in global tech

martin-veitch-thumbnail

What we know and don’t know about digital transformation

Martin Veitch's inside track on today’s tech trends

Most Recent Comments

Our Case Studies

IDG Connect delivers full creative solutions to meet all your demand generatlon needs. These cover the full scope of options, from customized content and lead delivery through to fully integrated campaigns.

images

Our Marketing Research

Our in-house analyst and editorial team create a range of insights for the global marketing community. These look at IT buying preferences, the latest soclal media trends and other zeitgeist topics.

images

Poll

Should companies have Bitcoins on hand in preparation for a Ransomware attack?