Cyber Incident Victim: New York Pizza
Date:
May 2021
Location:
Netherlands
Summary
A Dutch pizza chain suffered a security breach when a hacker stole data of approximately 3.9 million customers and attempted to extort the company by threatening to publish or sell the information. The compromised data included names, delivery addresses, email and telephone numbers, hashed passwords, order histories, and some birth dates. The organization engaged a security firm to investigate, patch vulnerabilities, and notified national data authorities while preparing a law enforcement complaint. Affected customers were advised to change account passwords and warned that the stolen data could be exploited for phishing, spam, fraud attempts, or identity theft, with specific alerts about suspicious communications from a known malicious email address.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On or around May 30, 2021, New York Pizza (NYP), a major pizza chain in the Netherlands, experienced a data breach after an unidentified hacker gained unauthorized access to customer information. The hacker initiated contact via email on the night of Sunday, May 30, or early Monday, May 31, explicitly threatening to publish or sell the stolen data unless extortion demands were met. NYP confirmed the breach publicly on May 31, disclosing that approximately 3.9 million customer records—equivalent to 22% of the Dutch population—were compromised. The stolen dataset included highly sensitive personal details: full names, physical delivery addresses, email addresses, telephone numbers, hashed passwords for NYP online accounts, historical order records, and, for some individuals, dates of birth. The company did not specify the exact intrusion method but acknowledged the hacker exploited a vulnerability in its systems to extract this data.
NYP engaged Dutch cybersecurity firm Fox-IT to investigate the breach, remediate the exploited vulnerability, and assess the intrusion’s scope. The company formally notified the Dutch data protection authority (Autoriteit Persoonsgegevens) and announced plans to file a criminal complaint with law enforcement upon completing its internal investigation. Impacted customers received direct notifications advising them to reset their NYP account passwords immediately. NYP explicitly warned that the stolen data would likely surface online and be weaponized for fraudulent activities, including phishing campaigns, spam, identity theft, or direct solicitations for payments or additional personal information. The chain singled out “[email protected]” as a confirmed malicious sender to avoid and emphasized vigilance against unsolicited communications referencing the breach. No ransomware deployment or operational disruption to restaurant services was reported, though the scale of exposed personal data raised significant fraud risks for affected individuals.