The iFood data breach exposed the data of over one million users. The vulnerability that allowed this is more common than it seems.

The iFood data breach took months to become public. The incident occurred in December 2025. Confirmation only came in June 2026, after criminals announced the sale of the data on dark web forums. The company didn't get ahead of the news; the news pushed them. According to a report by TecMundo, more than one million users had their names, CPF (Brazilian tax ID), phone numbers, and addresses exposed. iFood confirmed that passwords and financial data were not included. See the TecMundo report. See also the official iFood statement. Even so, the exposed information is sufficient for social engineering, unauthorized credit applications, and targeted phishing.

The flaw was in a system that should have been secure by definition.

The vulnerability was of the IDOR type, within SIRA, the iFood System for Responding to Authorities: an internal portal created to handle judicial, administrative, and health surveillance requests. A channel that was created to serve authorities ended up exposing ordinary citizens. An IDOR flaw occurs when a system allows someone to access another person's data by altering a simple parameter, such as an identification number. It is one of the oldest vulnerabilities in web development. Researchers have been documenting it for decades. It still appears in large company systems because it continues to be underestimated in security reviews.

The hackers' version points to a much larger scale.

While iFood admits to having over one million records compromised, a threat actor identified as “bacen” published a different claim on BreachForums: over 43 million records obtained from the platform, including CPF (Brazilian tax ID), email, phone number, and alleged payment information. The hacker gave the company until June 10, 2026, to pay a ransom, according to SC Media. Otherwise, they would release the data in stages. iFood denies evidence of a breach on this scale. Security researchers, however, point out that the two incidents may be independent, making both versions simultaneously true. Update: the deadline given by the hacker expired on June 10 without public confirmation of payment or release of the promised data.

The iFood data breach and the ANPD's response: the LGPD deadline was not respected.

Brazil's National Data Protection Authority (ANPD) has notified iFood to provide clarifications, as reported by CNN Brasil. The LGPD (Brazilian General Data Protection Law) is clear: companies must report incidents with potential risk to the authority and users within three business days. iFood chose not to send individual alerts to those affected, arguing that the ANPD waives notification when the risk is assessed as low. Experts dispute this interpretation: an exposed CPF (Brazilian taxpayer identification number) is a concrete risk. It is the key that opens credit, validates identity, and fuels fraud. The ANPD investigation remains open, and no fines have been announced. The LGPD provides for sanctions of up to 2% of gross revenue in Brazil, with a limit of R$ 50 million per infraction.

iFood data breach: how to protect your data now

Some measures are worth taking now. Activate two-step verification in the app. Monitor your CPF (Brazilian taxpayer ID) on the Central Bank's Registrato system to detect improperly opened credit lines. Access Registrato. Be suspicious of any contact that already knows your name, address, or order history: this is a clear sign of social engineering. Emails and SMS messages that use personal data to appear official are common phishing techniques after such data breaches.

What this case teaches us about data security and privacy.

The iFood data breach is symptomatic. Companies across all sectors accumulate customer data without formal protection processes, without knowing how to respond to incidents within the legal timeframe or how to properly communicate with authorities. When the breach occurs, the crisis is already underway. ISO 27001 covers exactly this area: technical controls, vulnerability management, incident response, and communication with affected parties. ISO 27701 extends this coverage to data privacy and compliance with the LGPD (Brazilian General Data Protection Law). Together, these standards address the type of gap that made the iFood case possible. If your company doesn't yet have a formal data security and privacy plan, the time to structure one is before the next incident, not after. Promove implements ISO 27001 and ISO 27701 and conducts assessments with certified assessors. Talk to us and understand what your company needs to achieve compliance.