11.18 Million Leaked Records: Before AI Agents Walk Into Your Stores, Who Should Hold the Keys to Member Data? | CEO Insights
Burger King Japan leaked 11.18 million member records, and 91APP and Zeabur were breached the same week. OakMega’s CEO unpacks the security risks of bringing AI agents into retail stores, the three questions to ask before you deploy, and how access control and human approval work in practice.
Porsche TsaiCEO
October 14 was an ordinary Wednesday.
That day, 91APP, a Taiwanese e-commerce technology provider, discovered that its Commerce Cloud database had been hit by an automated attack. On the same day, outsiders broke into the internal systems of Zeabur, a Taiwanese cloud deployment startup. The day before, Burger King Japan found unauthorized access to its app’s membership system—exposing as many as 11.18 million member records.
Three companies, two markets, one week. The outcomes could not have been more different: one filed a material disclosure, called the police, and warned customers about fraud; one set up a response committee; and one announced, three days later, that it would shut down by year-end.
I’m not here to talk about who got unlucky. I want to raise a bigger question: as every brand races to let AI agents take over member service, who should actually be trusted with member data?
My answer is simple. Letting AI agents safely into your stores isn’t about how smart the model is. It comes down to three things: give the agent only the minimum access it needs to do its job; make sure every API key has an owner and gets rotated regularly; and require human approval—with a record—for critical actions like changing data or issuing refunds. This week’s three incidents show that member data breaches have moved beyond IT incidents. They are now existential threats to brands.
Three Wake-Up Calls in One Week: Member Data Breaches Are No Longer Just IT’s Problem
Start with Burger King Japan. Attackers moved in and out of its systems between October 2 and 7; the company didn’t notice until the 13th. They took names, birthdays, member IDs, email addresses, home addresses, phone numbers, and mobile ordering history. Credit card numbers weren’t stored, which is a small mercy. But to a fraud ring, a detail like “you ordered a Whopper last Wednesday at noon” is more useful than a card number.
Burger King isn’t an isolated case. In the past month alone, Japanese cloud provider IDCF Cloud was hit by ransomware affecting 495 corporate and local government customers; travel platforms Skyticket and TEMAIRAZU leaked more than 18 million records combined; and Lawson, Mr Max, Times Car, and Yamaha all made the list too.
Then there’s Zeabur. In late August, attackers used a legacy API key to read project environment variables. On October 14 they came back a second time and got read access to the platform’s database. In a letter to users, the founder admitted that after weighing security, operational burden, and what it would take to keep running, he had decided to shut the service down.
Put these three side by side and the signal is clear: data breaches have gone from IT incidents to brand incidents—even existential ones. We used to call security a cost. Today it’s more like insurance—the kind where you only find out you were underinsured after something goes wrong.
Awkward Timing: The More Capable AI Gets, the More Keys There Are
The irony is that this wave of breaches lands right at the peak of the AI agent boom.
Major AI companies are racing to win legacy-system migration deals—moving member databases, POS, and customer service systems built more than a decade ago onto new platforms. Big CRM vendors, meanwhile, are pushing AI agents into retail stores: checking member points, recommending products, handling complaints, even editing orders directly.
Sounds great. But ask yourself one simple question: an AI agent that can look up members, change orders, and issue coupons for store staff—how many keys is it holding?
The answer: more than any single employee. A store associate can only look up data at their own store, during their shift, with their own account. An AI agent can work 24/7, across every store, querying 10,000 records a second. The more capable the agent, the more data it can touch—and an attacker who takes it over essentially gets a master key to the entire company.
That’s the lesson from Zeabur. The first breach came through a “legacy API key.” The second time, the attackers got into the database. The problem usually isn’t that the front door was unlocked—it’s that a forgotten spare key was lying in some corner. Once AI agents are deployed at scale, there will only be more of those spare keys, not fewer.
It’s Not the Cookware, It’s the Kitchen: Three Lines of Defense for AI Agents
I often use a restaurant to explain how companies adopt AI. The company is the restaurant. Member data, store processes, and customer service know-how are the ingredients. The AI agent is a new set of cookware. No matter how high-end the cookware, it won’t produce a dish worth serving on its own.
First, let’s define terms. An AI agent is an AI program that can look up data, make decisions, and take actions by itself. The biggest difference from a chatbot is that it doesn’t just answer questions—it can actually change data in your systems.
Security works the same way. Most breaches don’t happen because the pots are bad; they happen because the kitchen workflow is broken: raw and cooked food on the same cutting board, the back door left open, anyone free to walk into the freezer.
To let AI agents safely into your stores, the kitchen needs at least three things in place first:
- Tiered access: Just because a customer service agent can see an order’s status doesn’t mean it should see the member’s full address and birthday. This is what the security world calls the “principle of least privilege”: every account or system gets only the minimum data and permissions it needs to do its job.
- Every key has an owner: Every API key needs an owner, an expiration date, and a rotation record. A key nobody claims is a key left for attackers.
- Human approval for critical actions: Lookups can be handed to AI. But changing data, issuing refunds, and bulk exports require a person to press the approve button—and every approval must be logged.
Three lines of defense for AI agents
Every time an AI agent reads or writes member data, it has to pass through these three lines of defense in order.
These three things sound basic, but the hard part isn’t knowing them—it’s doing them. Every brand’s systems, processes, and organization are different, and there’s no off-the-shelf configuration you can apply in one click. Someone has to actually walk into the kitchen.
The OakMega Approach: Bring the AI Chef Into the Kitchen Instead of Carrying the Ingredients Out
That’s exactly why OakMega champions FDEs (Forward Deployed Engineers). We don’t hand clients a toolkit and walk away. We send people on-site to see where the brand’s member data lives, who can touch it, and how processes run—and only then decide what access the AI agent should get.
We don’t want security to be just talk, so here’s our baseline, out in the open:
- Multiple certifications, including ISO 27001, 27017, 27018, and CMMC
- Multi-cloud and private deployment
- SLA-backed operations
In practice, that means store agents and customer service agents on LINE. They can answer member questions instantly and help store staff look things up, but every agent operates under access control, and critical actions like changing data, issuing coupons, and processing refunds all require human approval.
An AI agent should save store staff time—not open a back door for hackers.
Before You Deploy AI Agents, Ask These Three Questions
The Burger King, 91APP, and Zeabur incidents aren’t meant to scare anyone away from AI. AI agents in stores are an unstoppable trend. The real dividing line is this: do you build the kitchen before hiring the chef, or hire the chef and patch the kitchen afterward?
If you’re evaluating AI agents, whoever you end up working with, I suggest asking three questions first:
- Exactly which member data can this agent see? Can it be given only the minimum access it needs to do its job?
- For every key in the system: who owns it, how often is it rotated, and who revokes it when someone leaves or a service is retired?
- For actions like changing data, issuing refunds, and bulk exports, who ultimately presses the approve button—and is there a record?
If you can answer all three, the AI agent is a helper. If you can’t, it’s the next headline.
Models will keep getting smarter—no need to worry about that. What’s worth worrying about is who’s actually holding the keys.
FAQ
Q: Do AI agents increase the risk of member data breaches?
Yes, if access isn’t controlled. AI agents can query large volumes of data across stores around the clock, so if one is compromised, the blast radius is far larger than a single employee account. Give it only the minimum access it needs and route critical actions through human approval, and you can keep the risk at a manageable level.
Q: What is the principle of least privilege?
The principle of least privilege means every account or system gets only the minimum data and operational permissions it needs to complete its task. For example, a customer service agent can check order status but can’t see a member’s full address or birthday.
Q: What’s the difference between ISO 27001, 27017, and 27018?
ISO 27001 governs an organization’s overall information security management. ISO 27017 covers security controls for cloud services. ISO 27018 covers the protection of personal data in public clouds. Holding all three means international standards are in place from management practices all the way to personal data in the cloud.
.webp)
