Massive Database Listings for Uber Eats and Starbucks on Cybercrime Forums

Threat actors are advertising databases containing 271 million records from Uber Eats and Starbucks on cybercrime marketplaces. The listings include 95 million records from Uber Eats and 176 million from Starbucks, allegedly collected via infostealing malware rather than direct breaches. Cybernews researchers found that the datasets correlate with a large collection of stolen credentials from June 2026. The sample records from both listings show that users are also present in previously leaked datasets, raising doubts about the legitimacy of these claims. Despite the absence of confirmed breaches, the exposed credentials pose a significant risk due to password reuse among users. Security experts warn that attackers could exploit these datasets to access various services, including banking and social media accounts. Both companies have not confirmed any security incidents related to these claims.

Key Points: • 271 million records from Uber Eats and Starbucks are being sold on cybercrime forums. • Data appears to be sourced from infostealing malware rather than direct breaches. • Exposed credentials could lead to significant risks due to user password reuse.