Hungry Lion: Customer Data Exposed in Ransomware Attack

Hungry Lion says it uses cryptographic techniques and access control mechanisms. (Photograph: Hungry Lion) Hungry Lion customer credentials appear to have been exposed for around nine months, with cyber security researchers identifying compromised accounts linked to the fast-food chain’s online customer portals. GalaxyWarden , pen-tester Brandon Audeh’s website, recently posted that Hungry Lion had been hit by a ransomware attack by MedusaLocker, which listed the fast-food chain on its leak site, claiming it holds data taken from the company. MedusaLocker, a ransomware-as-a-service threat actor, lists data taken as covering: “Fast food franchise (burgers, chicken, chips, ice cream) − 111 locations across South Africa, Botswana, Namibia, Zambia, Zimbabwe, Lesotho, Mauritius. Three POS systems: Unity POS (242MB monthly), GAAP POS (daily), CoSoft POS (145 terminals). | Botswana.” GalaxyWarden says this is a verbatim reproduction of MedusaLocker’s own leak-site posting. “This is the group’s claim, quoted verbatim; it is not GalaxyWarden’s reporting and has not been independently verified,” it says. Cyber security company SOCRadar says its analysis of stealer-log data found 23 records associated with Hungry Lion’s .co.za domain, including 13 customer accounts and another 10 numerical IDs whose profile type could not be determined. All of the records were linked to the fast-food chain’s consumer-facing web self-service portals and dated from October 2025 to July 2026, which the cyber security company says indicates customer data was continuously exposed for about nine months. SOCRadar says the exposed credentials appear to point to a risk of customer account takeovers rather than a direct breach of Hungry Lion’s corporate network. The concentration of credentials around its customer-facing portals suggests the information was compromised through consumers’ devices rather than Hungry Lion’s corporate systems. “All identified records relate to the company’s consumer-facing web self-service portals,” says SOCRadar. It says this is significant because Hungry Lion’s online ordering platform and loyalty programme aggregate customer personal data, potentially making the company an attractive target for ransomware groups seeking sensitive information. The company says the sustained exposure warrants an assessment of whether customers need to be notified under the Protection of Personal Information Act, as well as a review of Hungry Lion’s web portal and online ordering infrastructure. SOCRadar adds that the credential exposure does not establish how MedusaLocker gained access to Hungry Lion for the ransomware attack. MedusaLocker group “typically releases stolen data if ransom demands are not met,” it says. “MedusaLocker has been actively targeting various sectors, including healthcare, manufacturing and the public sector, over the past 60 days,” says SOCRadar. It adds that targeting of Hungry Lion, a retail company heavily reliant on customer engagement and data, “presents a slightly different profile compared to the typically more industrial or public sector targets frequently associated with MedusaLocker’s recent activities”. KnowBe4 Africa, however, interprets the same incident differently. It says the ransomware attack that hit Hungry Lion appears to have exposed point-of-sale records rather than customers’ personal information, an initial analysis by cyber security firm DarkNotify has found. Anna Collard, SVP content strategy and CISO advisor at KnowBe4 Africa, says: “What incidents like this consistently expose is not one careless person but how an organisation behaves in the hours after something goes wrong.” Collard adds its research finds that, where secure behaviour is built into everyday work, most employees feel safe reporting a mistake the moment they spot it and that speed is what limits damage. “Too many organisations still meet an honest error with a formal warning, which teaches people to stay quiet,” says Collard. Shoprit