Desert De Oro Foods Data Breach Impacts Sensitive Personal Info of Employees

Desert De Oro Foods Inc, a private restaurant franchise operator that runs Taco Bell, KFC and Pizza Hut locations as a Yum Brands franchisee, disclosed a data breach that exposed personal information belonging to current and former employees.

An unauthorized third party gained access to the corporate email account and computer of a Desert De Oro Foods employee between Aug. 5 and 12, 2026. Desert De Oro Foods discovered the breach on Aug. 12, 2026.

Upon discovering the unauthorized access, the company's IT team blocked the third party from further access and took steps to secure its systems. Desert De Oro Foods then engaged third-party cybersecurity experts to conduct a comprehensive investigation into the incident.

The investigation found that the unauthorized third party may have had access to human resources data stored within the compromised email account and computer.

The types of personal information potentially exposed included names, Social Security numbers and health insurance identification numbers (also known as member IDs).

The breach was reported to the Massachusetts Office of Consumer Affairs and Business Regulation on Sept. 26, 2026.

Desert De Oro Foods mailed impacted consumers notification letters on Sept. 26, 2026.

Desert De Oro Foods' response to the breach

Desert De Oro Foods is offering affected individuals identity protection services through Experian's IdentityWorks at no cost.

Affected individuals must enroll by Nov. 30, 2026, to take advantage of the offered services. Individuals can sign up online at Experian's IdentityWorks enrollment page or by phone at 833-931-7577.

Affected individuals who have questions can contact the company's human resources department at 928-681-3349.