iFood confirms December 2025 breach exposing names, phones, addresses and CPF numbers of 1.2 million users
Brazilian delivery app iFood confirmed a December 2025 breach of about 1.2 million users' names, phone numbers, addresses and CPF taxpayer IDs. A hacker claims 43.8 million; iFood disputes it. Expect phishing that uses your details, and trust only the official app.
If you use iFood, be wary of calls, texts or messages that quote your name, CPF or address, and trust only messages inside the official iFood app. Do not pay or reply to anyone claiming to hold your data.
What’s happening
On 3 June 2026 Brazilian food-delivery company iFood confirmed that a breach in December 2025 exposed registration data for about 1.2 million users, roughly 2% of its customers. The data includes names and CPF numbers, Brazil's taxpayer identity numbers, and Hackread also reports phone numbers and addresses. iFood says passwords, payment methods, bank details and financial records were not taken, and calls the incident isolated and quickly contained. A hacker using the alias "bacen" had posted on BreachForums on 28 May claiming 43.8 million customer records and demanded payment by 10 June. iFood says it found no evidence that 43 million people were affected. That claim is unverified. Brazil's data protection authority, the ANPD, said iFood had not reported the incident and that it had asked the company for information. iFood said it did not report because the event posed no relevant risk. Reporting we read does not say iFood told affected users directly, and we found no later outcome from the ANPD or a change in iFood's figures.
- What
- Breach
- Affects
- iFood food-delivery app and service (Brazil)
- Fixed in
- Nothing to patch
- Since
- 3 June 2026
- Closed
- 4 June 2026
Timeline
- Update
Hackread reported that iFood had not notified affected users directly, and that another hacker, "Harold", told TecMundo the 1.2 million figure was a separate December incident and a larger, more recent theft might be real. Neither claim was verified.
- Update
Brazil's data protection authority (ANPD) said iFood had not reported the incident to it and that it had asked the company for information. iFood said it did not report because the event posed no relevant risk or damage to users under the regulator's criteria.
- Made publicNothing to patch
iFood said a leak from December 2025 exposed registration data, including names and CPF taxpayer numbers, of about 1.2 million users, roughly 2% of its base. It said passwords, payment methods and financial records were not taken, and that it had found no evidence that 43 million users were affected.
- Update
A hacker using the alias "bacen" posted on the BreachForums criminal forum, claiming to hold about 43.8 million iFood customer records and threatening to leak them in stages unless paid by 10 June.
Sources
- iFood confirma vazamento de dados de 1,2 milhão de usuários do aplicativoCNN Brasil · 3 June 2026
- iFood confirms data breach affecting Brazil usersHackread · 4 June 2026