Brazilian Food-Delivery Giant iFood Targeted in Alleged 43.8M-Record Customer Data Extortion
iFood breach exposes 43.8M Brazilian customer records including CPF IDs and payment data.
Run iFood?
Get an email when a reviewed story names iFood, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A threat actor using the alias 'bacen' claims to possess 43.8 million customer records from Brazilian food-delivery platform iFood, allegedly including CPF national IDs, full names, emails, phone numbers, and credit-card data. The attacker is reportedly conducting an extortion campaign around the stolen data. This represents a significant data exposure affecting a major Brazilian service provider.
The lesson from this incident
Full lessoniFood, Brazil's largest food delivery platform, suffered a major data breach exposing 43.8 million customer records including sensitive personal and financial information such as national IDs, contact details, and credit card data. The incident highlights critical failures in data protection controls and access management that allowed an attacker to exfiltrate massive amounts of customer information. This breach demonstrates how inadequate data security can lead to extortion campaigns and massive regulatory exposure, particularly given Brazil's LGPD privacy regulations.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Incident response retainer
Experts are on call before the worst day, not searched for during it.