2026 iFood — bacen 43.8M customer-record extortion claim (unverified)
Data compromised
Actor-claimed: ~43,847,219 customer records including CPF, names, emails, phones, credit-card data, account fields—unverified
Technical writeup
Unverified leak-site / extortion claim — observed May 28, 2026. Dark Web Informer reported actor bacen advertising a pay-or-leak listing against Brazilian food-delivery giant iFood, citing roughly 43.8 million customer records with CPF national IDs, names, emails, phones, and credit-card data, plus user/admin samples. iFood had not publicly addressed this specific listing in sources reviewed. This claim is cataloged separately from iFood's company-confirmed ~1.2 million-user breach (Dec 2025 activity, disclosed June 2026). Treat the 43.8M figure as unverified actor marketing.
Root cause
Unverified forum pay-or-leak extortion by actor bacen alleging theft of ~43.8M iFood customer records—distinct from iFood's confirmed ~1.2M Dec 2025 incident; company had not addressed this claim at catalog time