Starbucks disclosed a breach after phishing attacks on its employee portal led to unauthorized access to Partner Central accounts, exposing staff data.
Starbucks reported a data breach affecting hundreds of employees after phishing attacks targeted its Partner Central employee portal. The security breach was detected on February 6, the incident involved unauthorized access to staff accounts, potentially exposing personal information stored in the system.
“On or about February 6, 2026, Starbucks Corporation (“Starbucks” or “we”) became aware of potential unauthorized access to certain Starbucks Partner Central accounts. Upon becoming aware, Starbucks commenced an investigation and began taking measures to assess and contain the incident. In connection with those efforts, we retained leading experts and notified certain law enforcement authorities.” reads the data breach notification letter shared with the Maine Attorney General’s Office. “The investigation has determined that an unauthorized third party accessed certain Starbucks Partner Central accounts after obtaining the login credentials through websites impersonating Partner Central. Based on the types of information viewable within those accounts, some of your personal information may have been impacted.”
Unauthorized access to employee accounts at Starbucks occurred between January 19 and February 11, according to the breach notification. The incident impacted nearly 900 employees (889).
Compromised data includes employee information, including names, Social Security numbers, dates of birth, and bank account and routing numbers. The company launched an investigation, notified law enforcement, and strengthened security controls for Partner Central accounts. To support affected individuals, Starbucks is offering 24 months of identity protection and restoration services through Experian IdentityWorks, which includes identity theft detection and recovery assistance.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, data breach)
