Skip to navigation

Threat reportData BreachTL-2026-1578

Alleged Starbucks Data Breach — Threat Actor 'anes2010' Claims 176M Customer Records for Sale on Cybercrime Forum

mediumTRACKING

A threat actor using the handle 'anes2010' is advertising a database allegedly containing 176 million unique Starbucks customer records for $400 on a cybercrime forum, claiming emails, usernames, password hashes, loyalty/rewards data, and Starbucks Card balance/auto-reload details extracted in June 2026.

Key facts for anes2010 Starbucks data claim

IdentifiersTL-2026-1578
SeverityMEDIUM
Exploitation statusNo known exploitation
Affected productsStarbucks Corporation Starbucks Rewards / Starbucks Card customer accounts (mobile app and web)
MalwareLumma Stealer - S1213, Raccoon Stealer - S1148, RedLine Stealer - S1240, Vidar Stealer
MITRE ATT&CK techniquesT1005 Data from Local System, T1078 Valid Accounts, T1119 Automated Collection, T1213 Data from Information Repositories, T1518 Software Discovery, T1537 Transfer Data to Cloud Account, T1539 Steal Web Session Cookie, T1552 Unsecured Credentials, T1555 Credentials from Password Stores, T1565 Data Manipulation, T1566 Phishing, T1567 Exfiltration Over Web Service and 6 more in the attack flow
MotivationFINANCIAL
Target sectorsretail, food-and-beverage, hospitality
Target regionsNorth America, Global
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for anes2010 Starbucks data claim

As of 2026-07-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1578 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Non-Browser Process Reading Browser Credential/Cookie Store (Infostealer Harvesting)

Detects a script interpreter (PowerShell, cmd) or other non-browser process reading files named like browser 'Login Data' or 'Cookies' stores, consistent with commodity infostealer (RedLine/Raccoon/Lumma/Vidar-class) credential and session-cookie harvesting implicated in the suspected stealer-log origin of the alleged Starbucks 176M-record listing.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1555.003, T1539
  • Data sources: sysmon, windows_security, edr_file_events
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where match(TargetFilename, "(?i)\\\\(Login Data|Cookies)$")
| where match(Image, "(?i)\\\\(powershell\.exe|pwsh\.exe|cmd\.exe|wscript\.exe|cscript\.exe)$")
| where NOT match(Image, "(?i)\\\\chrome\.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(TargetFilename) as files_accessed by Computer, User, Image
| where count > 0

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName in~ ("Login Data", "Cookies")
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe")
| where InitiatingProcessFileName !~ "chrome.exe"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName
| summarize count(), files=make_set(FileName) by DeviceName, AccountName, InitiatingProcessFileName

Sigma

title: Suspected Infostealer Browser Credential/Cookie File Access
id: 8f2a1c4e-7b31-4d9e-9a0e-1a2b3c4d5e6f
status: experimental
description: Detects a non-browser process (script interpreter) reading browser 'Login Data' or 'Cookies' store files, consistent with commodity infostealer credential/session-cookie harvesting (RedLine, Raccoon, Lumma, Vidar).
references:
    - https://attack.mitre.org/techniques/T1555/003/
    - https://attack.mitre.org/techniques/T1539/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-20
tags:
    - attack.credential-access
    - attack.t1555.003
    - attack.t1539
    - attack.tool.redline_stealer
    - attack.tool.raccoon_stealer
    - attack.tool.lumma_stealer
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains:
            - '\Login Data'
            - '\Cookies'
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    filter:
        Image|contains: '\chrome.exe'
    condition: selection and not filter
falsepositives:
    - Backup or profile-migration/sync tooling legitimately reading browser stores
    - Endpoint security agents performing credential-store scanning
level: high

Known false positives:

  • Legitimate browser-profile backup/migration or password-manager sync tooling reading the same store files
  • EDR/AV credential-store scanning engines

Tuning notes: Baseline known IT-approved backup/sync utilities and add them to the filter clause; scope to consumer/BYOD endpoint fleets first given the loyalty-app login vector, then expand if corporate laptops show the same pattern.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Non-Browser Process Reading Browser Credential/Cookie Store (Infostealer Harvesting) · unlock with TL Creds
  • Autorun Registry Persistence Correlated with Temp-Directory Drop File (Post-Harvest Staging) · unlock with TL Creds
  • Archive Creation Correlated with Upload to Unfamiliar Cloud Storage Domain (Bulk Exfil) · unlock with TL Creds
  • Suspected Infostealer Browser Credential/Cookie File Access · unlock with TL Creds
  • Registry Run Key Persistence Following Suspicious Script Execution · unlock with TL Creds
  • High-Velocity Sequential Login Attempts With Varying Usernames (Credential Stuffing) · unlock with TL Creds
  • Autorun Registry Key Persistence Following Script-Generated Drop File (Post-Harvest Staging) · unlock with TL Creds
  • Archive Creation Followed by Outbound Transfer to Unfamiliar Cloud Storage Domain (Bulk Exfil) · unlock with TL Creds

Indicators of compromise for anes2010 Starbucks data claim

As of 2026-07-20, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-1578.

15 indicators of compromise · unlock with TL Creds. Compare plans

How anes2010 Starbucks data claim works

Starbucks has not confirmed the incident; researchers note the sample data may originate from mass infostealer 'stealer log' collections rather than a direct breach of Starbucks infrastructure.

On July 19, 2026, a threat actor operating under the handle 'anes2010' posted a listing on an undisclosed cybercrime forum offering a database of 176 million unique Starbucks user accounts for $400. The seller claims the data was extracted in June 2026 and includes email addresses, usernames, password hashes, city/country location data, account creation dates, account status, and email verification status, alongside Starbucks-specific fields: Starbucks Card balances, auto-reload preferences, preferred store/beverage preferences, birthdays, Starbucks Rewards points, lifetime Stars, and total spending history. The actor provided sample records to establish credibility, a common tactic on cybercrime marketplaces, though industry reporting is explicit that sample authenticity does not establish that a full dataset is genuine, current, or was obtained directly from the named organization.

As of this writing, Starbucks has issued no public confirmation of the incident, and no independent forensic validation of the dataset's authenticity, completeness, or direct sourcing from Starbucks systems has been published. No CVE, exploited vulnerability, or confirmed initial-access vector has been identified or attributed to this specific listing.

Secondary reporting introduces a credible alternative explanation: cybernews researchers examining a related, contemporaneous claim of 271 million combined Uber Eats and Starbucks records concluded the underlying data may have been aggregated from mass infostealer ('stealer log') collections harvested from infected consumer endpoints — i.e., credentials and session data siphoned by malware such as RedLine, Raccoon, Lumma, or similar commodity infostealers when users logged into the Starbucks mobile app or website on compromised devices — rather than exfiltrated via a direct compromise of Starbucks' backend infrastructure. This would mean the 'breach' framing may be a mischaracterization of a credential-stuffing/stealer-log aggregation event, a pattern increasingly common in 2025-2026 dark-web listings that bundle scattered infostealer logs under a single high-profile brand name to increase resale value and buyer interest.

The listing occurs against a backdrop of a genuinely turbulent 2026 threat landscape for Starbucks: the company confirmed a separate, verified breach in which a phishing/social-engineering attack against an employee of a third-party business partner compromised the Partner Central portal between January 19 and February 11, 2026, exposing personal and financial data of 889 individuals. Separately, in early April 2026 extortion actors (reported under the handles 'Shadowbyt3$' and 'BlackVortex1' across different outlets, likely the same underlying incident or closely coordinated campaigns) posted on DarkForums.su claiming compromise of Starbucks operational technology — including Mastrena II espresso machine control logic, beverage dispenser firmware (.hex binaries), the Global Management UI source code, JavaScript bundles exposing API endpoints, source maps, and developer backup folders potentially containing credentials — demanding a $500,000 ransom with an April 5, 2026 deadline. Older, confirmed incidents include a 2022 breach of Starbucks Singapore affecting roughly 220,000 customers, and Starbucks' downstream exposure to the November 2024 Termite ransomware attack against supply-chain software provider Blue Yonder.

Taken together, this listing must be tracked as an UNVERIFIED claim pending confirmation from Starbucks, but it sits inside a real pattern of repeated targeting of the Starbucks brand and its customer/loyalty ecosystem by financially motivated actors across 2022-2026, spanning credential-based consumer data claims, confirmed partner-portal phishing compromise, supply-chain ransomware fallout, and OT/source-code extortion.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1119 Automated Collection; T1213 Data from Information Repositories

Initial Access

T1078 Valid Accounts; T1566 Phishing

Discovery

T1518 Software Discovery

Exfiltration

T1537 Transfer Data to Cloud Account; T1567 Exfiltration Over Web Service

Credential Access

T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Impact

T1565 Data Manipulation; T1657 Financial Theft

Resource Development

T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1588 Obtain Capabilities

Reconnaissance

T1594 Search Victim-Owned Websites; T1596 Search Open Technical Databases

Remediation for anes2010 Starbucks data claim

Immediate actions

  • Starbucks Rewards/loyalty account holders should proactively rotate account passwords and enable multi-factor authentication where available.
  • Monitor Starbucks Card balances and auto-reload payment methods for unauthorized transactions or balance drains.
  • Treat unsolicited emails/SMS referencing Starbucks Rewards, gift card balances, or account verification with heightened scrutiny pending confirmation of the breach.
  • Do not reuse the password associated with any Starbucks account on other services; if reused, rotate it everywhere.
  • Enterprises should flag internal traffic to known infostealer log marketplaces and cybercrime forums referenced in this listing.

Workarounds

  • Until Starbucks confirms or denies the incident, treat any Starbucks account credentials as potentially exposed and apply defense-in-depth (MFA, unique passwords, payment monitoring) rather than waiting on official confirmation.

Longer-term hardening

  • Deploy endpoint detection focused on commodity infostealer malware families (RedLine, Raccoon, Lumma, Vidar) given the suspected stealer-log origin of similar large-brand data listings.
  • Implement credential-stuffing and anomalous-login detection on consumer-facing loyalty/rewards platforms.
  • Establish dark-web/underground-forum monitoring for brand-name mentions to shorten detection-to-confirmation time for future claims.
  • Harden third-party/business-partner portal access (lesson from the confirmed Jan-Feb 2026 Partner Central phishing compromise) with phishing-resistant MFA.

Affected and fixed versions

  • Starbucks Corporation — Starbucks Rewards / Starbucks Card customer accounts (mobile app and web)
    Vulnerable versions: Consumer accounts allegedly extracted June 2026

Timeline of anes2010 Starbucks data claim

  • Starbucks Singapore suffers a data breach affecting approximately 220,000 customers (earliest confirmed Starbucks customer-data incident in this pattern).
  • Termite ransomware attack against supply-chain software provider locked-ioc-14 disrupts operations for downstream customers including Starbucks.
  • Confirmed phishing/social-engineering attack begins against a Starbucks business partner employee with access to the Partner Central portal.
  • Confirmed Partner Central compromise window closes; personal and financial data of 889 individuals confirmed exposed. Starbucks later discloses this incident publicly.
  • Extortion actor(s) reported as 'locked-ioc-12'/'locked-ioc-13' post on locked-ioc-9 claiming compromise of Starbucks operational technology (Mastrena II espresso machine firmware, Global Management UI source code, API endpoints), demanding $500,000 with an April 5, 2026 deadline.
  • Threat actor 'locked-ioc-15' claims the 176-million-record customer database was extracted from Starbucks around this date (exact date unconfirmed).
  • A related/contemporaneous cybercrime-forum listing offers a combined 271 million Uber Eats and Starbucks records; researchers assess the data likely originates from mass infostealer stealer-log collections rather than a direct company breach.
  • 'locked-ioc-15' posts the 176-million-record Starbucks database listing for $400 on an undisclosed cybercrime forum, including sample records.
  • TL-Intel-Harness ingests the claim via RSS hunt phase and opens TL-2026-1578 for tracking as an unverified breach claim.
  • Cyber Security News, Cybernews, Futureproof, and other outlets report on the unverified claim; Starbucks has not issued a public confirmation or denial.

Sources cited for anes2010 Starbucks data claim

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats