Starbucks has allegedly been listed on a cybercrime forum by a threat actor using the handle “anes2010,” who claims to be selling a database containing 176 million unique user records reportedly extracted in June 2026.
Starbucks has not publicly confirmed the alleged security incident, and the claim has not been independently verified. As a result, both the reported breach and the dataset’s contents should be treated as unconfirmed at the time of writing.
The threat actor allegedly advertised the claimed Starbucks database for $400 and reportedly provided sample records to support the sale.
Cybercriminal sellers often share samples to make breach claims appear credible. However, samples alone do not establish that an entire dataset is genuine, up to date, or obtained directly from the named organization.
According to a post shared by the threat intelligence account Intel and Breaches, the forum listing claims the alleged database contains email addresses, usernames, password hashes, country and city details, account creation dates, last activity dates, account status, and email verification status.
Starbucks Database Leak
The actor further alleges that the database contains Starbucks Card details and balances, auto-reload settings, preferred stores, and beverage preferences.
The claimed records may also include birthdays, Starbucks Rewards points, lifetime Stars, total spending, and currency information.
If genuine, this combination of account, loyalty, and personal data could present substantial privacy and fraud risks for affected customers.
Password hashes are not necessarily plaintext passwords. However, the real risk depends on the password-hashing algorithm, its configuration, the presence of unique salts, and the organization’s security controls.
Weak or outdated hashing methods may enable attackers to attempt offline password cracking. Email addresses and detailed loyalty-program data could also support highly targeted phishing campaigns.
Attackers could send fraudulent messages about reward points, account suspensions, Starbucks Card balances, payment updates, auto-reload changes, or account verification to steal credentials or payment information.
Users who reuse passwords across multiple websites face greater risk if the alleged records are confirmed and passwords are eventually exposed or cracked.
Credential stuffing can allow attackers to test reused username-and-password combinations against email, banking, retail, and social-media accounts.
Starbucks customers should be cautious of unexpected emails, SMS messages, or calls that claim urgent action is needed on their Starbucks account.
Users should avoid clicking links in unsolicited messages and instead open the official Starbucks mobile app or visit the company’s official website directly.
Customers should use a unique, strong password for their Starbucks account and avoid reusing that password on any other service.
They should also monitor Starbucks Card balances, rewards activity, stored payment methods, and account profile changes for suspicious activity.
The authenticity, origin, and full scope of the alleged Starbucks dataset remain unknown. Starbucks, independent researchers, and breach-monitoring organizations will need to validate the claim before it can be treated as a confirmed compromise.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
The post Threat Actors Allegedly Listed Starbucks Data on Hacker Forums appeared first on Cyber Security News.
