Bazooka Data Breach
The September 2024 Bazooka data breach occurred when threat actors breached the online ordering, mobile application, and customer database infrastructure of Bazooka Fried Chicken (bazookaegy.com), a leading fast-food restaurant franchise operating across Egypt and the Middle East.
Exposed Data Types
3- Email addresses
- Names
- Phone numbers
About This Breach
The incident compromised customer profiles registered via the company's iOS, Android, and web applications, exposing over one million customer records publicly on breach forums.
What information was affected in the Bazooka incident?
The compromised export includes registered customer records from the restaurant's CRM and ordering databases. The leak affected 752,549 unique customer profiles, exposing the following categories of personal data:
- Personal Identity Details: First names, last names, and unique system customer identifiers (id).
- Contact Credentials: Canonical email addresses and mobile telephone numbers.
- Platform Telemetry: Originating platform registration source (iOS application, Android application, or website).
How many accounts were affected?
Canonical verification and deduplication confirmed 752,549 unique canonical email addresses across 1,065,042 raw customer membership rows.
Technical analysis and security risks
The leak directly exposes customer contact coordinates in conjunction with mobile telephone numbers and full names. This combination significantly heightens the risk of mobile smishing, parcel or delivery fraud simulations, WhatsApp social engineering, and targeted credential phishing campaigns targeting Middle Eastern consumers.
Recommended actions for affected users
Customers who registered or ordered through Bazooka Egypt should:
- Exercise caution regarding SMS messages, WhatsApp inquiries, or emails purporting to be from delivery drivers, restaurants, or payment processors asking for OTPs or login credentials.
- Never click unverified links claiming to offer discounts, loyalty rewards, or order tracking.
- Ensure multi-factor authentication (MFA / 2FA) is enforced across primary email accounts.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
