# Alleged Żabka Polska Breach: 541K Jira Issues, 230K IT Tickets, 89 GitLab Repos, and Cloudflare/MongoDB/Broker Credentials Offered for €5,000

> A forum account created 2026-08-02 and used only once claims to be selling a full data dump from Żabka Polska — Poland's largest convenience-store franchise (11,000+ locations) — for €5,000: exactly 541,463 Jira issues, 229,734 IT service-desk tickets, source code from 89 GitLab repositories, Cloudflare API keys, a MongoDB admin password, and messaging-broker credentials, including one reusable 62-character GitLab access token embedded across all 89 repo clone URLs. Third-party reviewer Ransomnews confirmed the headline record counts as exact matches, though secondary claims (35,206 GDPR-reference records, ~4,000 bank-account mentions) largely did not surface in the reviewed samples, and Żabka has issued no public confirmation.

- **Published:** 2026-08-03T00:00:00Z
- **Last reviewed:** 2026-08-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1834
- **ID:** TL-2026-1834
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-08-02, a brand-new account on an underground cybercrime forum posted a single listing — 14 minutes after registration and with zero prior trading history — offering a purported full data dump from Żabka Polska for €5,000. Żabka Polska is the franchise-operating subsidiary of publicly traded Żabka Group, Poland's largest convenience-store network with more than 11,000 locations; notably, the listing appeared just two days after Alimentation Couche-Tard publicly announced a PLN 32.62 billion (~€7.56B/US$8.6B) agreement to acquire a controlling stake in Żabka Group (2026-07-31), a timing coincidence that raises the possibility of deliberate extortion or reputational-pressure leverage tied to the pending tender offer, though this motive is not confirmed by any source.

The claimed dump spans internal collaboration and DevOps tooling rather than customer-facing systems: exactly 541,463 Jira issues and 229,734 IT service-desk tickets, plus source code from 89 GitLab repositories. Reporting further details the repository architecture: the leaked estate includes the internal cs-market platform, comprising 44 DevOps repositories, 26 backend services, 7 frontend applications, and an API gateway — giving a buyer not just code but a structural blueprint of how Żabka's retail platform is decomposed and deployed. Most significantly, the seller claims a single 62-character GitLab personal access token was embedded across all 89 repository clone URLs — a credential-reuse pattern that, if the token is still valid, would grant uniform access to Żabka's entire disclosed source-code estate rather than requiring per-repository compromise. The same repositories reportedly contain hardcoded Cloudflare API keys, a MongoDB administrative password, and messaging-broker credentials within infrastructure-as-code files — a textbook case of CWE-798 (Use of Hard-Coded Credentials) at organizational scale.

Leaked Jira/service-desk tickets reportedly reference Żabka's internal technology stack by name: the Nowa Kasa point-of-sale platform, the Cyberstore and zMarket platforms, SAP ERP, and a Lotto (lottery) integration, plus IT vendors Accenture, Netguru, and BlueSoft among more than 17 additional third parties named across the tickets — giving any buyer a de facto architecture map of Żabka's retail and back-office technology estate, and its outsourced-development supply chain, even before touching the source code itself.

Independent verification is partial. Ransomnews reviewed sample archives and confirmed the headline counts (541,463 Jira issues; 229,734 service-desk tickets) as exact matches to the seller's claims, lending strong credibility to the listing's scale. However, two more precise-sounding secondary claims — 35,206 GDPR-reference records and roughly 4,000 bank-account mentions within the dump — largely failed to surface in the reviewed samples, tempering confidence in the listing's completeness or accuracy beyond the core Jira/service-desk/GitLab figures. Żabka has not issued a public statement confirming or denying a breach as of this writing. Poland's RODO (the national GDPR implementation) requires a data controller to notify the national supervisory authority within 72 hours of becoming aware of a qualifying breach; absent public confirmation, it is unclear whether that regulatory clock has started. The threat actor's identity, initial access vector, and dwell time remain unknown; the forum account's brand-new, single-use, zero-history profile is consistent with a burner/sock-puppet account created specifically to monetize already-stolen data rather than an established data-broker persona. Ticket timestamps reportedly suggest the underlying data was assembled before the Couche-Tard tender offer became public, which argues against the listing being crafted purely in reaction to the acquisition news, even though the two-day proximity remains a notable coincidence.

Even unconfirmed, the exposure pattern described — a reusable high-privilege GitLab token, cloud API keys, and a database admin password all embedded in source code shared across dozens of repositories — represents a severe supply-chain and downstream-compromise risk: any buyer with a working token gains read (and potentially write) access to Żabka's proprietary retail, POS, and ERP-integration codebases, from which further credentials, business logic, or injectable code paths could be harvested for follow-on attacks against Żabka's franchise and POS infrastructure.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1650 Acquire Access
- T1199 Trusted Relationship
- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1560 Archive Collected Data
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft
- T1591 Gather Victim Org Information
- T1594 Search Victim-Owned Websites
- T1087 Account Discovery
- T1619 Cloud Storage Object Discovery
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1550 Use Alternate Authentication Material
- T1074 Data Staged

## Sources

- [Alleged Żabka breach exposes Jira data, source code, and API keys](https://securityaffairs.com/196510/data-breach/alleged-zabka-breach-exposes-jira-data-source-code-and-api-keys.html)
- [Alimentation Couche-Tard Announces Agreement to Acquire Controlling Stake in Żabka Group and Launches Voluntary Tender Offer (corporate release)](https://corporate.couche-tard.com/2026-07-31-ALIMENTATION-COUCHE-TARD-ANNOUNCES-AGREEMENT-TO-ACQUIRE-CONTROLLING-STAKE-IN-ZABKA-GROUP-AND-LAUNCHES-VOLUNTARY-TENDER-OFFER)
- [Alimentation Couche-Tard Announces Agreement to Acquire Controlling Stake in Żabka Group and Launches Voluntary Tender Offer](https://www.prnewswire.com/news-releases/alimentation-couche-tard-announces-agreement-to-acquire-controlling-stake-in-abka-group-and-launches-voluntary-tender-offer-302839695.html)
- [Alimentation Couche-Tard Announces Agreement to Acquire Controlling Stake in Żabka Group and Launches Voluntary Tender Offer](https://finance.yahoo.com/markets/stocks/articles/alimentation-couche-tard-announces-agreement-041000336.html)
- [Couche-Tard agrees Żabka acquisition in 32.62bn-zloty deal](https://www.retail-insight-network.com/news/couche-tard-agrees-zabka-acquisition/)
- [Alimentation Couche-Tard Announces Agreement to Acquire Controlling Stake in Żabka Group and Launches Voluntary Tender Offer (Żabka Group)](https://zabkagroup.com/alimentation-couche-tard-announces-agreement-to-acquire-controlling-stake-in-zabka-group-and-launches-voluntary-tender-offer/)
- [Alimentation Couche-Tard Announces Agreement to Acquire Controlling Stake in Żabka Group and Launches Voluntary Tender Offer (CVC)](https://www.cvc.com/media/news/2026/alimentation-couche-tard-announces-agreement-to-acquire-controlling-stake-in-zabka-group-and-launches-voluntary-tender-offer/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1834