McDonald's Indonesia left more than 40 million records exposed to the public internet through an unsecured customer data platform, according to research published this week by the Cybernews security team. The discovery adds another major brand to a growing list of companies caught storing sensitive customer data behind misconfigured databases.
The researchers found the data sitting in a publicly accessible MongoDB database tied to McDonald's Indonesia's Customer Data Platform (CDP) — the system companies use to centralize customer profiles, loyalty activity, and marketing data. No password or authentication was required to browse it.

What was inside the open database

Of the 40 million-plus exposed records, roughly 28 million were customer records. Those files contained names, email addresses, phone numbers, and device identifiers — the exact kind of personal detail that makes phishing and social engineering campaigns effective.
The remaining records included more than 71,000 corporate files, most of them related to advertising campaigns, as well as sales information and loyalty card data. Because CDPs aggregate information from many touchpoints, a single exposed database can quietly offer a detailed picture of how customers interact with a brand.
The researchers noted that the database was simply left exposed — there was no sophisticated intrusion involved. McDonald's Indonesia has since closed the database, so it is no longer publicly accessible. Cybernews said it had reached out to the company for comment.

A loyalty program in the crosshairs

The exposed loyalty point transaction data is a particular concern. Loyalty accounts have become an attractive target for fraudsters because points can be converted into real-world purchases with relatively little scrutiny — and because customers rarely watch their point balances as closely as their bank statements.
The researchers warned that affected individuals could face an increase in social engineering attempts via email or scam calls.
With names, phone numbers, and purchase history in hand, scammers can craft highly convincing messages that appear to come from McDonald's itself — for example, fake promotions, delivery notifications, or "account verification" requests designed to steal passwords or payment details.
Customer data platforms are especially risky when misconfigured because they deliberately pull together identifiers from many sources: app activity, loyalty cards, email campaigns, and sales records. A single misstep can expose far more than any one of those systems would on its own.

What customers should do now

If you have a McDonald's Indonesia account or app, the standard precautions apply: be skeptical of unsolicited emails, messages, or calls claiming to be from the company, and never hand over passwords, one-time codes, or payment details in response to an unexpected message.
Consider reviewing your loyalty account for unfamiliar redemptions, and if you reused your McDonald's password on other services, change those passwords too. When a phone number and email address leak together, criminals often try them as login credentials elsewhere.
The incident is a reminder that the biggest cybersecurity risks are often the simplest ones. A misconfigured database, an open port, or a default password can do as much damage as a sophisticated attack — and major brands are expected to treat customer data platforms with the same care as any critical system.
McDonald's Indonesia has not yet commented publicly on how long the database was exposed or whether the data was accessed by anyone other than the researchers.
By Hamza Faisal