Starbucks Data Breach: Employee Data Exposed in Partner Central Hack

Starbucks Employee Data Exposed in Breach Affecting Hundreds

Starbucks has confirmed a data breach impacting hundreds of employees, stemming from unauthorized access to accounts within its Partner Central system. The incident, discovered on February 6, 2026, compromised accounts used to manage employment details, personal information, benefits, and human resources data. This disclosure adds to a recent history of cybersecurity challenges for the coffee giant, including incidents affecting both its internal systems and those of its vendors.

The company, operating nearly 41,000 locations globally and employing over 380,000 individuals known as “partners,” revealed the breach in notification letters filed with the Maine Attorney General and sent to affected employees on Tuesday. According to the notification, a joint investigation with cybersecurity experts identified 889 compromised Partner Central accounts. The attackers gained access by obtaining login credentials through websites designed to mimic the legitimate Partner Central portal.

How the Breach Unfolded

Between January 19 and February 11, threat actors were able to access sensitive employee data. This data includes names, Social Security numbers, dates of birth, and financial account and routing numbers. Starbucks has not publicly explained the five-day delay between discovering the unauthorized access and removing the threat actors from its systems. The company stated, in its notification, that it “became aware of potential unauthorized access” on February 6th, and that the investigation determined the attackers accessed accounts after obtaining login credentials through phishing-like websites.

This type of attack, known as credential harvesting, relies on deceiving users into entering their login information on fraudulent websites that closely resemble legitimate ones. These websites are often distributed through phishing emails or malicious links. The success of such attacks highlights the importance of multi-factor authentication (MFA), a security measure that requires users to provide multiple forms of verification before granting access to an account. Whereas Starbucks has not confirmed whether MFA was in place for Partner Central accounts, its implementation could have significantly mitigated the impact of this breach.

Broader Cybersecurity Context for Starbucks

This isn’t the first time Starbucks has faced a significant cybersecurity incident. In September 2022, the company’s Singapore division confirmed a data breach affecting over 219,000 customers, resulting from a compromise of a third-party vendor’s systems. BleepingComputer reported on the incident, detailing how customer data stored by the vendor was exposed.

More recently, in November 2024, Starbucks experienced disruptions due to a ransomware attack targeting Blue Yonder, a supply chain software provider used by the coffee chain. Reuters covered the fallout, explaining how the “Termite” ransomware gang compromised Blue Yonder’s systems, impacting Starbucks’ supply chain operations. This incident underscores the growing risk of supply chain attacks, where vulnerabilities in third-party vendors can be exploited to target larger organizations.

Impact and Response

The immediate impact of the Partner Central breach is the potential for identity theft and financial fraud for affected employees. Starbucks has notified law enforcement and is providing impacted partners with two years of free identity theft protection and credit monitoring services through Experian IdentityWorks. Employees have also been advised to monitor their bank accounts for any suspicious activity.

The breach also raises concerns about the security of sensitive employee data held by large corporations. The exposure of Social Security numbers and financial account details can have long-lasting consequences for individuals, requiring them to take proactive steps to protect themselves from fraud.

What Comes Next: Strengthening Security and Monitoring

Starbucks has stated It’s taking measures to “further strengthen security controls related to access to Starbucks Partner Central accounts.” Specific details of these measures haven’t been released, but potential steps include implementing or strengthening multi-factor authentication, enhancing phishing detection capabilities, and improving employee training on cybersecurity best practices.

The company will likely face scrutiny from regulators and potentially legal action from affected employees. The incident also serves as a reminder for other organizations to review their own security posture and ensure they have adequate measures in place to protect sensitive data. Ongoing monitoring of the dark web for compromised credentials and proactive threat hunting will be crucial in preventing future incidents.

Further investigation will be needed to determine the full extent of the damage and identify any vulnerabilities that contributed to the breach. The incident highlights the evolving threat landscape and the need for continuous investment in cybersecurity to protect against increasingly sophisticated attacks. BleepingComputer’s initial reporting suggests the attackers gained access through websites impersonating Partner Central, emphasizing the importance of verifying website authenticity.