2025 iFood — confirmed breach; 1.2M users (Dec 2025; disclosed June 2026)
Data compromised
Names, phones, addresses, CPF numbers per company notice
Technical writeup
Brazilian food-delivery platform iFood confirmed in early June 2026 that a December 2025 incident affected approximately 1.2 million users (~2% of its base)—names, phone numbers, addresses, and CPF tax IDs—while stating passwords, bank details, and card data were not taken. Hackread and SC Media noted a separate BreachForums actor claimed ~43.8 million records with a June 10, 2026 ransom deadline, which iFood disputed as unverified. BreachHistory uses the company-attested 1.2M figure.
Root cause
Unauthorized access to customer data (isolated incident per iFood; actor dispute on scale)