11M Jollibee customers affected by data breach

THE National Privacy Commission (NPC) on Monday reported that it had been notified by fast food giant Jollibee Foods Corp. (JFC) of a data breach affecting some 11 million customers.

Information includings as dates of birth and senior citizen identification card numbers were compromised during a June 22 security incident, the agency said.

«Approximately 11 million data subjects are affected, the majority of whom are Jollibee customers,» the NPC said.

«Other impacted brands include Mang Inasal, Red Ribbon, Chowking, Greenwich, Burger King, Yoshinoya, and Panda Express.»

By law, companies and individuals processing personal data must notify the NPC and individual affected subjects within 72 hours of discovering a breach.

JFC was said to have requested 20 days to complete its internal investigation.

«The company is addressing the incident and has implemented its response protocols and deployed enhanced security measures to further protect the company's and its subsidiaries' data against threats,» it told the stock exchange on Monday.

Advertisement

«The company has also launched its investigation on the matter to understand the scope of this incident, and is currently working with the relevant authorities and experts in its investigation,» it added.

JFC said that its e-commerce platforms, including those of its subsidiaries' brands, were unaffected by the incident and remained operational.

«JFC recognizes the value and importance of the confidentiality of personal information of its stakeholders,» it said in the disclosure.

«The company assures the public of its commitment to prioritize the protection and confidentiality of such personal information, including customer data, by continuously fortifying its defenses against future threats,» it added.

Advertisement

The JFC data breach is the latest to be reported to the NPC.

Last week, health care firm Maxicare said the personal data of some 13,000 customers that had used the booking platform of a third-party service provider were compromised in a June 13 incident.

The affected customers comprised less than one percent of its members and the leaked data did not include sensitive medical information, Maxicare claimed.

On June