Papa John's Egypt listed by the Nightspire ransomware group

Overview

The Nightspire ransomware group has listed Papa John's Egypt, the Egyptian franchise of the international pizza chain, on its leak site. The listing appeared on 16 May 2026.

What was published

The group's post lists the following categories of data:

• Banking and financial records
• Personal data
• Critical point of sale (POS) data

POS data is of particular concern as it can relate to payment card processing.

Risks for affected individuals

• Customers' payment card data may be at risk through POS records.
• Personal data could enable identity theft.
• Banking records may be misused.

What remains unknown

• The volume of records involved.
• Whether card data is stored in plain text or tokenised.
• The timeline of any release.

What affected people should do

Customers who paid by card should monitor statements for unusual transactions and report any suspicious activity to their bank. The franchise should notify customers and the brand, secure POS systems, and coordinate with payment processors.