Golden Corral breach exposed data on more than 183,000 employees

Golden Corral Corporation, the North Carolina based operator of the American buffet restaurant chain, began notifying current and former employees in February 2024 that their personal information had been stolen in an intrusion the previous summer.

According to the company's notification, an unauthorised party accessed its systems and acquired data between August 11 and August 15, 2023. Golden Corral identified the incident on August 15, when it disrupted parts of corporate operations. The review to determine whose data was involved was completed on January 26, 2024, and notifications to individuals and regulators began on February 16.

A filing with the Maine Attorney General's office put the number of people affected at 183,272. The data varied by person and could include names, Social Security numbers, driver's licence numbers, financial account information, medical and health insurance information, and usernames and passwords. Records belonging to employees' dependants and beneficiaries were also caught up in the incident.

Golden Corral said it was unaware of any misuse of the information and offered those notified 24 months of complimentary credit monitoring and identity restoration services. Proposed class actions were filed in the US District Court for the Eastern District of North Carolina within weeks, arguing that the company had failed to safeguard the data and had waited roughly six months to tell those affected.