Starbucks Discloses Data Breach Affecting Hundreds of Employees

Starbucks has disclosed a cybersecurity incident that exposed sensitive personal information belonging to hundreds of employees after attackers gained unauthorized access to internal HR accounts.

The company confirmed that 889 employee accounts were compromised following a phishing campaign targeting its internal workforce portal, based on breach notification filings submitted to regulators and reporting from multiple cybersecurity outlets.

The incident involved Starbucks’ Partner Central platform, an internal system employees — referred to by the company as “partners” — use to manage payroll, benefits, scheduling, and other HR-related information.

Phishing Campaign Used to Steal Login Credentials

The breach began with a credential phishing campaign designed to trick employees into entering their login details on a fraudulent website that mimicked the legitimate Partner Central portal.

Once victims entered their credentials, attackers were able to log into the real system using those stolen usernames and passwords.

Starbucks said it identified potential unauthorized access on February 6, 2026, which prompted the company to launch an internal investigation and begin containment measures.

Security researchers note that phishing campaigns targeting corporate login portals remain one of the most common methods attackers use to gain an initial foothold inside organizations.

Sensitive Employee Data Potentially Exposed

Regulatory breach notifications indicate that attackers may have accessed personal information stored within the compromised employee accounts.

The exposed data could include:

• Names
• Social Security numbers
• Dates of birth
• Financial account numbers
• Bank routing numbers

Because the affected system is used for payroll and employment management, the incident raises potential risks of identity theft or financial fraud for impacted workers.

At this time, Starbucks has not indicated that customer information or payment systems were compromised.

Company Investigation and Response

After discovering the incident, Starbucks launched a forensic investigation and notified law enforcement authorities. The company has begun informing affected employees and providing guidance on steps they can take to protect their personal information.

Organizations that experience breaches involving sensitive employee records commonly offer identity monitoring or credit protection services, though the full scope of Starbucks’ remediation efforts has not been detailed in any disclosure.

HR Platforms Increasingly Targeted by Attackers

Security analysts say the incident highlights a growing trend in enterprise cyberattacks: human resources platforms are increasingly targeted because they contain highly valuable personal data.

Employee portals often store information such as tax documents, payroll data, and Social Security numbers — making them attractive targets for cybercriminals seeking financial gain or identity theft opportunities.

Credential phishing continues to be one of the most effective techniques for breaching corporate systems, particularly when attackers can trick employees into entering credentials into convincing fake login portals.

A Reminder of Identity Security Risks

Starbucks operates more than 40,000 stores globally and employs hundreds of thousands of workers, creating a large digital identity footprint across its internal systems.

Incidents like this demonstrate how identity platforms and workforce portals represent a significant attack surface for large organizations, especially when attackers rely on phishing and stolen credentials rather than technical exploits.

Security professionals say organizations can reduce these risks by implementing measures such as:

• phishing-resistant authentication
• multi-factor authentication (MFA)
• security awareness training
• monitoring for suspicious login activity

As investigations continue, the Starbucks incident underscores how credential-based attacks remain one of the most persistent threats facing corporate networks today.