McDonald’s Indonesia has secured an exposed database that leaked more than 40 million records, according to Cybernews researchers.

The open MongoDB instance contained about 28 million customer records, including names, email addresses, phone numbers and device identifiers, along with loyalty programme data.

The database has now been closed and is no longer accessible online, Cybernews said. It is not clear how long the data was exposed or whether anyone else accessed it.

Indonesia has seen a string of large data leaks this year as companies struggle to secure cloud databases. Customer records from such leaks are often sold on cybercrime forums.

McDonald’s has not publicly commented on the incident. Security experts advise customers to watch for phishing messages using their personal details.

Open databases are a common cause of leaks, often left exposed by misconfigured cloud settings. Indonesia’s data protection law allows fines for companies that fail to secure personal data.