iFood Confirms Data Leak That Affected 1.2 Million Users

Overview

• iFood disclosed Wednesday that an incident traced to December 2025 affected about 1.2 million users, which the company says equals roughly 2% of its customer base.
• The company says exposed fields were mainly users' names and CPF numbers and that it found no evidence of leaked account passwords, full payment card data, or transaction records.
• Criminal actors had earlier posted sample files and claimed far larger totals—about 43.8 million records—on Paste.sh and underground forums, creating conflicting public claims.
• Independent reporting and sample analysis have raised the possibility the SIRA authority‑response portal was exploited, possibly using an account tied to law‑enforcement, but that technical origin remains unverified and under investigation.
• The exposure of CPF and name records raises clear risks for identity fraud and social‑engineering schemes, and iFood says it contained the incident, is following LGPD procedures and continues security and forensic work.