Dark Web Intel: Waffle Factory Database Dump Exposed 251,808 Customer Records

HEROIC analysts detected a database breach affecting Waffle Factory, a Belgian-origin fast-casual restaurant chain with locations across Europe, in February 2025. The incident exposed 251,808 customer records containing personal contact details and identifying information. No passwords were included in this dataset, but the scope of the personal data, names, birthdates, email addresses, and phone numbers, is more than enough to sustain targeted phishing and identity fraud campaigns.

What an Attacker Can Do With Names, Birthdays, and Contact Details

This breach contains no passwords, but that does not make it safe. Attackers combine personal details like full names, birthdates, and phone numbers to craft highly convincing phishing messages, impersonate victims when calling customer service lines, and answer security questions on banking or government platforms. A birthday paired with a full name is often enough to reset account passwords through identity verification services. The email addresses in this dataset guarantee a direct line to every affected person, making mass phishing campaigns trivially easy to execute.

What Was Exposed

• Email Address: Primary contact point for phishing and account recovery attacks
• Phone Number: Enables voice phishing calls and SMS scam messages
• Birthday: Used to answer identity verification questions and personalize scam attempts
• First Name and Last Name: Allows attackers to address victims by name and appear legitimate

Why This Matters: Personal Data Fuels Identity Theft and Financial Fraud

Consumer-facing businesses like restaurant chains accumulate detailed personal profiles through loyalty programs, online ordering, and promotional sign-ups. When that data leaks, it flows directly into fraud pipelines. Attackers use name-and-birthday combinations to apply for credit in victims' names, redirect packages, and convince customer service agents to make unauthorized account changes. The 251,808 records from this breach represent 251,808 people who are now identifiable and reachable by any threat actor who downloaded the dataset from dark web forums.

How Food and Hospitality Database Breaches Happen

Restaurant and hospitality brands often collect customer data through loyalty apps, online reservation systems, and digital ordering platforms, many of which are managed by third-party vendors. A database breach in this sector typically results from a compromised web application, an insecure third-party integration, or an attacker who gains access to the customer relationship management system where order and loyalty data is stored. Once access is obtained, the attacker exports the customer table in bulk and lists the dataset on dark web marketplaces, where consumer PII is consistently in demand for identity fraud and targeted marketing scams.

Check If Your Waffle Factory Data Appeared on the Dark Web

HEROIC's free breach scanner covers more than 400 billion records sourced from leaked databases, dark web forums, and breach compilations. If your email address was part of the Waffle Factory database dump, the scan will surface it instantly. Visit HEROIC to run a free check and see every known breach where your personal information has appeared.