# Alleged Starbucks Data Breach — Threat Actor 'anes2010' Claims 176M Customer Records for Sale on Cybercrime Forum

> A threat actor using the handle 'anes2010' is advertising a database allegedly containing 176 million unique Starbucks customer records for $400 on a cybercrime forum, claiming emails, usernames, password hashes, loyalty/rewards data, and Starbucks Card balance/auto-reload details extracted in June 2026. Starbucks has not confirmed the incident; researchers note the sample data may originate from mass infostealer 'stealer log' collections rather than a direct breach of Starbucks infrastructure.

- **Published:** 2026-07-20T00:00:00Z
- **Last reviewed:** 2026-07-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1578
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-anes2010-starbucks-data-claim-tl-2026-1578.webp?v=342a8922 (Threadlinqs threat intel: anes2010 Claims 176M Starbucks Records: Detection & IOCs (TL-2026-1578) — Medium severity, 15 IOCs, 9 detection rules.)
- **ID:** TL-2026-1578
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** TRACKING
- **Detections:** 9 (1 shown free below) · **IOCs:** 15

## Description

On July 19, 2026, a threat actor operating under the handle 'anes2010' posted a listing on an undisclosed cybercrime forum offering a database of 176 million unique Starbucks user accounts for $400. The seller claims the data was extracted in June 2026 and includes email addresses, usernames, password hashes, city/country location data, account creation dates, account status, and email verification status, alongside Starbucks-specific fields: Starbucks Card balances, auto-reload preferences, preferred store/beverage preferences, birthdays, Starbucks Rewards points, lifetime Stars, and total spending history. The actor provided sample records to establish credibility, a common tactic on cybercrime marketplaces, though industry reporting is explicit that sample authenticity does not establish that a full dataset is genuine, current, or was obtained directly from the named organization.

As of this writing, Starbucks has issued no public confirmation of the incident, and no independent forensic validation of the dataset's authenticity, completeness, or direct sourcing from Starbucks systems has been published. No CVE, exploited vulnerability, or confirmed initial-access vector has been identified or attributed to this specific listing.

Secondary reporting introduces a credible alternative explanation: cybernews researchers examining a related, contemporaneous claim of 271 million combined Uber Eats and Starbucks records concluded the underlying data may have been aggregated from mass infostealer ('stealer log') collections harvested from infected consumer endpoints — i.e., credentials and session data siphoned by malware such as RedLine, Raccoon, Lumma, or similar commodity infostealers when users logged into the Starbucks mobile app or website on compromised devices — rather than exfiltrated via a direct compromise of Starbucks' backend infrastructure. This would mean the 'breach' framing may be a mischaracterization of a credential-stuffing/stealer-log aggregation event, a pattern increasingly common in 2025-2026 dark-web listings that bundle scattered infostealer logs under a single high-profile brand name to increase resale value and buyer interest.

The listing occurs against a backdrop of a genuinely turbulent 2026 threat landscape for Starbucks: the company confirmed a separate, verified breach in which a phishing/social-engineering attack against an employee of a third-party business partner compromised the Partner Central portal between January 19 and February 11, 2026, exposing personal and financial data of 889 individuals. Separately, in early April 2026 extortion actors (reported under the handles 'Shadowbyt3$' and 'BlackVortex1' across different outlets, likely the same underlying incident or closely coordinated campaigns) posted on DarkForums.su claiming compromise of Starbucks operational technology — including Mastrena II espresso machine control logic, beverage dispenser firmware (.hex binaries), the Global Management UI source code, JavaScript bundles exposing API endpoints, source maps, and developer backup folders potentially containing credentials — demanding a $500,000 ransom with an April 5, 2026 deadline. Older, confirmed incidents include a 2022 breach of Starbucks Singapore affecting roughly 220,000 customers, and Starbucks' downstream exposure to the November 2024 Termite ransomware attack against supply-chain software provider Blue Yonder.

Taken together, this listing must be tracked as an UNVERIFIED claim pending confirmation from Starbucks, but it sits inside a real pattern of repeated targeting of the Starbucks brand and its customer/loyalty ecosystem by financially motivated actors across 2022-2026, spanning credential-based consumer data claims, confirmed partner-portal phishing compromise, supply-chain ransomware fallout, and OT/source-code extortion.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1586 Compromise Accounts
- T1566 Phishing
- T1078 Valid Accounts
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1119 Automated Collection
- T1567 Exfiltration Over Web Service
- T1537 Transfer Data to Cloud Account
- T1518 Software Discovery
- T1657 Financial Theft
- T1565 Data Manipulation
- T1596 Search Open Technical Databases
- T1594 Search Victim-Owned Websites

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Non-Browser Process Reading Browser Credential/Cookie Store (Infostealer Harvesting)** (`TL-2026-1578-SPL-001`)

Detects a script interpreter (PowerShell, cmd) or other non-browser process reading files named like browser 'Login Data' or 'Cookies' stores, consistent with commodity infostealer (RedLine/Raccoon/Lumma/Vidar-class) credential and session-cookie harvesting implicated in the suspected stealer-log origin of the alleged Starbucks 176M-record listing.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1555.003, T1539
- **Data sources:** sysmon, windows_security, edr_file_events
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where match(TargetFilename, "(?i)\\\\(Login Data|Cookies)$")
| where match(Image, "(?i)\\\\(powershell\.exe|pwsh\.exe|cmd\.exe|wscript\.exe|cscript\.exe)$")
| where NOT match(Image, "(?i)\\\\chrome\.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(TargetFilename) as files_accessed by Computer, User, Image
| where count > 0
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName in~ ("Login Data", "Cookies")
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe")
| where InitiatingProcessFileName !~ "chrome.exe"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName
| summarize count(), files=make_set(FileName) by DeviceName, AccountName, InitiatingProcessFileName
```

### Sigma

```yaml
title: Suspected Infostealer Browser Credential/Cookie File Access
id: 8f2a1c4e-7b31-4d9e-9a0e-1a2b3c4d5e6f
status: experimental
description: Detects a non-browser process (script interpreter) reading browser 'Login Data' or 'Cookies' store files, consistent with commodity infostealer credential/session-cookie harvesting (RedLine, Raccoon, Lumma, Vidar).
references:
    - https://attack.mitre.org/techniques/T1555/003/
    - https://attack.mitre.org/techniques/T1539/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-20
tags:
    - attack.credential-access
    - attack.t1555.003
    - attack.t1539
    - attack.tool.redline_stealer
    - attack.tool.raccoon_stealer
    - attack.tool.lumma_stealer
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains:
            - '\Login Data'
            - '\Cookies'
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    filter:
        Image|contains: '\chrome.exe'
    condition: selection and not filter
falsepositives:
    - Backup or profile-migration/sync tooling legitimately reading browser stores
    - Endpoint security agents performing credential-store scanning
level: high
```

**Known false positives:**

- Legitimate browser-profile backup/migration or password-manager sync tooling reading the same store files
- EDR/AV credential-store scanning engines

**Tuning notes:** Baseline known IT-approved backup/sync utilities and add them to the filter clause; scope to consumer/BYOD endpoint fleets first given the loyalty-app login vector, then expand if corporate laptops show the same pattern.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Non-Browser Process Reading Browser Credential/Cookie Store (Infostealer Harvesting) (locked: unlock with TL Creds)
- Autorun Registry Persistence Correlated with Temp-Directory Drop File (Post-Harvest Staging) (locked: unlock with TL Creds)
- Archive Creation Correlated with Upload to Unfamiliar Cloud Storage Domain (Bulk Exfil) (locked: unlock with TL Creds)
- Suspected Infostealer Browser Credential/Cookie File Access (locked: unlock with TL Creds)
- Registry Run Key Persistence Following Suspicious Script Execution (locked: unlock with TL Creds)
- High-Velocity Sequential Login Attempts With Varying Usernames (Credential Stuffing) (locked: unlock with TL Creds)
- Autorun Registry Key Persistence Following Script-Generated Drop File (Post-Harvest Staging) (locked: unlock with TL Creds)
- Archive Creation Followed by Outbound Transfer to Unfamiliar Cloud Storage Domain (Bulk Exfil) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Threat Actors Allegedly Listed Starbucks Data on Hacker Forums](https://cybersecuritynews.com/alleged-starbucks-data-breach/)
- [Hackers claim Starbucks data breach, but researchers are not so sure](https://cybernews.com/security/starbucks-data-breach-claims-lack-evidence/)
- [Infostealers to blame? Hackers claim 271 million Uber Eats and Starbucks records are up for sale](https://cybernews.com/security/uber-eats-starbucks-stealer-logs/)
- [Starbucks Data Breach: 176M Records Reportedly Stolen — What to Know](https://futureproof.app/blog/hacker-claims-starbucks-data-breach-involving-176-million-records-what-to-know/)
- [Starbucks: 176 million accounts allegedly leaked](https://www.secnews.gr/en/722624/starbucks-isxirismoi-diarrhea-dedomenon/)
- [Starbucks Confirms Data Breach from a Social Engineering Attack on a Business Partner](https://www.cpomagazine.com/cyber-security/starbucks-confirms-data-breach-from-a-social-engineering-attack-on-a-business-partner/)
- [Starbucks Data Breach Allegation: Key Risks Revealed](https://darknetsearch.com/knowledge/news/en/starbucks-data-breach-allegation-key-risks-revealed/)
- [Inside the Starbucks breach trilogy](https://shieldworkz.com/blogs/inside-the-starbucks-breach-trilogy)
- [Starbucks Data Breach Impacts Employees](https://www.securityweek.com/starbucks-data-breach-impacts-employees/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1578