A few clicks later, Ms Stevens, with her husband George Carter beside her, realised she could view other Menulog customers' private information, including phone numbers, home addresses and email addresses.

"We live in Fairlight, Sydney, and yet we were seeing what Beth in Melbourne had recently ordered," the early childhood educator said.

"We then clicked on my account details and up came a Letitia in Dulwich Hill with her mobile number, home address and email address, and on navigating to the front page again it said 'Hi Peter' with a list of his recent orders in Melbourne."

Menulog told Fairfax Media on April 9 – when the incident occurred – it made a "technical change" to the web cache, which allowed a "limited number" of customers to see the private details of other customers using the website at the same time.

But Fairfax Media is aware of similar cases stretching back to last year. Menulog has also failed to notify its 1.4 million active customers of the data breach, so that anyone who has suffered financial loss or identity theft can take action.

According to the Office of the Australian Information Commissioner, "an entity mistakenly provid[ing] personal information to the wrong person" constitutes a data breach.

It follows a story in February which revealed a security flaw in Menulog's system had led to an employee of a restaurant partner stumbling upon the names and email addresses of more than 1.1 million customers.

IT security expert Ty Miller, of Threat Intelligence, said Menulog's reason for the latest data leak made sense.

"The web cache, it basically sits in front of your website and it takes a copy of the common files like images … to speed up the back-end system," he said.

"The problem seems to be they didn't set up their cache controls properly, meaning the system started caching account profile pages, which someone else can request, and leaking data out of the application."

Mr Miller said Menulog should have notified users of both data breaches.

"It's sensitive data and it's the sort of information that can be used and sold on the underground market as a starting point to performing things like identity theft," he said.

The federal government is considering an amendment to the Privacy Act that would require companies with a turnover of more than $3 million a year to notify customers of a serious data breach within 30 days if there is a "real risk of serious harm" to the person to whom the information relates.

A Menulog spokesman said when it was alerted to the issue it shut down the website and resolved the problem in minutes, putting in place additional change controls to prevent another incident.

"We are confident that no one had the ability to log into an account other than their own, and we do not store customer credit card details," the spokesman said.

"We have contacted everyone who brought this to our attention and we encourage any customer who is still concerned to call us."

On April 9, several customers alerted Menulog via social media.

But in March, one customer told Fairfax Media she encountered the problem twice in the past year and "was able to see the individual's full name, address, phone number, and opt to use their saved credit card information".

Ms Stevens and Mr Carter said their main concern was the security of their credit card details.

Menulog's privacy policy says it does not save credit card details. Instead, it saves a reference to a user's card, called a token. The token is provided by the payment provider.

Do you know more? EHan@fairfaxmedia.com.au