iMenu360 2022 Data Breach
The iMenu360 2022 data breach involved the exposure of 3,425,860 customer records believed to have come from online ordering systems used by restaurants.
Exposed Data Types
5- Email addresses
- Latitude and longitude pairs
- Names
- Phone numbers
- Physical addresses
About This Breach
The verified breach record stores 11 August 2022 in its date field while its description places the data in approximately late 2022. Public evidence does not establish an exact access or publication day, so those entries are not converted into a more precise technical timeline.
The source record says multiple attempts were made to contact iMenu360 between April and August 2023 without a response. The event is therefore supported by the verified dataset and breach records; it is not presented as though the company publicly confirmed the event, entry method, actor, or response.
What information was present?
Confirmed fields are email addresses, names, phone numbers, physical addresses, and latitude-longitude pairs. The sources do not list passwords, usernames, payment cards, bank accounts, or products ordered. They also do not establish that every field appeared in every record. Because an address combined with coordinates can identify a home, workplace, or another delivery point more precisely, the event is sensitive from a location-privacy perspective.
Privacy boundary and safe next steps
An email match does not establish that a person ordered from a particular restaurant, which products were purchased, that a payment occurred, or that the person still lives at a listed address. Those inferences should not be shared or used against anyone. Unexpected delivery, refund, coupon, address-verification, or payment-update messages should be checked through a known restaurant or ordering-service channel rather than a link in the message. Because password and card data are not confirmed for this event, this record alone should not be treated as proof that either was exposed.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
