iFood Says Hacker Exposed 1.2 Million Brazilians Names and Tax IDs

Brazil · Technology

Latin America’s largest food-delivery company has confirmed a data breach affecting more than a million customers — and is now disputing a hacker’s claim that the true scale is dozens of times larger.

What the iFood data breach exposed

iFood, the food-delivery app that handles roughly 120 million orders a month for some 60 million customers across more than 1,500 Brazilian cities, said in a statement on Wednesday that personal data belonging to about 1.2 million users had been exposed. That figure represents close to 2% of its customer base. According to the company, the leaked information was limited to registration details — users’ full names and their CPF, the individual taxpayer identification number that functions as Brazil’s primary personal identifier. iFood said no passwords, payment methods, financial records or transaction histories were affected, and that it found no evidence of access to banking data.

The company characterised the episode as an isolated incident that took place in December 2025 and was quickly neutralised by its security protocols at the time. It said it operates in compliance with Brazil’s General Data Protection Law, known by its Portuguese acronym LGPD, and reminded customers to treat only the platform’s official channels as legitimate sources of communication about the matter.

A six-month delay and a regulator’s questions

One of the most contested aspects of the disclosure is its timing. The breach dates to December 2025, but iFood made it public only this week — roughly six months later. The company argued that Brazilian law waives the requirement to notify affected individuals when an incident does not create a relevant risk or harm, under the criteria set by the data-protection regulator. That justification is now itself under scrutiny.

The National Data Protection Authority, the ANPD, has requested explanations from iFood and signalled it will assess the incident’s severity, weighing factors such as the type of data exposed, the number of people affected and the potential consequences. The authority noted that even where the extent of harm is uncertain, the data controller — in this case iFood — is obliged to adopt adequate preventive measures. For a company that holds the tax IDs and contact details of tens of millions of Brazilians, the regulatory question is whether the low-risk classification that justified the delayed disclosure will hold.

The disputed 43.8 million-record claim

iFood’s confirmation followed reporting by Brazilian technology outlets and a claim circulating on a dark-web hacking forum. A user of BreachForums, a marketplace where stolen material is bought and sold, asserted last week to hold data on more than 43.8 million Brazilian iFood customers — a set said to include not only names and tax IDs but also emails, phone numbers and credit-card information. A separate cybersecurity monitor warned that, if accurate, such a trove could enable large-scale identity and financial fraud, including mass phishing campaigns using verified contact details. The actor reportedly demanded that iFood make contact by June 10 and pay an unspecified sum.

iFood pushed back firmly on the larger figure. The company said that after repeated analyses it found no evidence that 43 million user records had been leaked, and that the material posted online corresponds to the same isolated December 2025 incident it had already identified and contained. The gap between the company’s account and the criminal’s claim — and whether they describe one breach or two — remains unresolved, and is part of what the regulator will examine.

Why it matters beyond Brazil

iFood is one of Latin America’s most prominent technology champions, a Brazilian platform that has fended off well-funded challengers including a relaunch of China’s Didi-owned 99Food and the regional arrival of Meituan’s Keeta. A breach touching the personal identifiers of more than a million users — and a louder, unverified claim of a far bigger one — lands at a moment when the region’s data-protection regimes are still maturing and enforcement records are thin. For foreign investors watching Brazil’s digital economy, the episode is a test of how aggressively the ANPD will police disclosure obligations, and of how much reputational and regulatory risk sits inside the consumer-data holdings of the platforms that now mediate everyday life across the country.