Introduction:In 2023, it was reported that approximately 200,000 customers of Starbucks in Singapore had their personal data compromised, with the leaked information having reportedly circulated on the dark web as early as September. What exactly was tampered with? Is credit card information safe? How did the company respond? This article provides a detailed account of the incident, explores the root causes of the key vulnerabilities, and offers practical cybersecurity advice to help consumers avoid digital risks.
Singapore’s Starbucks recently experienced a serious data breach, where the personal information of around 200,000 e-commerce users who had placed orders through the official app or website was obtained by unknown individuals and offered for sale on online forums. It is understood that this batch of data first appeared on the dark web on September 10, with one file containing sensitive user information even being sold for 3,500 Singapore dollars. However, the actual amount of data leaked remains to be verified.
On September 16, Starbucks sent notification emails to affected users, emphasizing that credit card data was not stored within its systems and therefore was not impacted by this incident. The company also stated that members’ points, stored value, and accumulated rewards remained intact. Officials further explained that the leaked data was limited to registered users who had made transactions via digital platforms.
A spokesperson for Starbucks Singapore confirmed to the media that after being notified by the cybersecurity team on September 13, the company immediately activated its emergency response protocol. In addition to proactively contacting affected customers, it fully cooperated with the relevant regulatory authorities in the investigation. While the exact method of the data leak has not yet been determined, additional encryption measures have been implemented to strengthen system security.
An in-depth investigation revealed that this incident may be related to the leakage of an API key from Starbucks’ backend system. This key was accidentally exposed on the open-source code platform GitHub, allowing attackers to gain access to the internal system. The risk level was assessed as Critical, the highest possible. Cybersecurity expert Kumar was the first to identify this vulnerability, not only providing a link to the problematic GitHub repository but also demonstrating how the key could be used to tamper with the list of authorized users.
Notably, it took three weeks after Kumar submitted the vulnerability report for Starbucks to officially respond. Although the response time sparked discussion, the company ultimately offered a substantial bounty of 4,000 USD (significantly higher than the usual range of 250–375 USD), promptly removed the problematic code repository, and replaced all related credentials. This handling is considered one of the most significant cybersecurity remediation actions in Starbucks’ history.
With the widespread adoption of cloud services, companies are facing increasingly complex cybersecurity challenges. In recent years, multiple large-scale personal data breaches have occurred globally, affecting hundreds of millions of people and resulting in economic losses that are difficult to estimate. Although businesses generally deploy protective measures such as firewalls, encryption technologies, and biometric authentication, defensive gaps can still emerge when facing targeted attacks.
A Starbucks spokesperson reiterated that protecting customer privacy is the company’s top priority and that it will continue to upgrade its cybersecurity systems and enhance employee training. The Personal Data Protection Commission of Singapore also confirmed that it has launched an investigation, requesting Starbucks to explain the incident and outline its improvement plans. For consumers, it is advised to regularly check for unusual account activity, enable two-factor authentication, and avoid entering sensitive information on untrusted platforms.
The above content is compiled by CoffeeHunters, a coffee news website.
