Starbucks Reports Employee Data Breach Following Credential Theft Campaign
Learn More
Starbucks Corporation, reports a data breach on March 10, 2026, affecting its internal HR and workplace platform. The incident was caused by from a credential theft phishing campaign targeting employees. The company discovered the unauthorized access on February 6, 2026 and the breach was contained by February 11, 2026.
Attackers used social engineering by creating deceptive websites that impersonated the Starbucks Partner Central portal. Employees were tricked into entering their credentials on these fraudulent sites, allowing the threat actors to gain direct access to legitimate accounts. The investigation confirmed that the unauthorized access persisted between January 19 and February 11, 2026.
The compromised data includes:
- Full names
- Social Security numbers
- Dates of birth
- Financial account numbers
- Routing numbers
The number of affected individuals is 889.
Starbucks isolated the affected accounts and notified law enforcement agencies to assist in the investigation. Impacted employees are being provided with 24 months of complimentary identity theft protection and credit monitoring services.
