[mothered]

McDonald's also told US employees that the attackers could only steal business contact info belonging to US employees and franchises that wasn't personal or sensitive

It becomes sensitive If an attacker uses the Information to play the role of the employee on a business level, then social engineer another branch by verifying himself, and gain access to restricted data.

Having a given & family name, employee title and the branch number, Is sometimes enough to successfully manipulate In the above capacity.