iFood

Brazil's Tribunal Superior do Trabalho (Superior Labor Court) ruled, in a decision reported September 29, 2026, that iFood can be held subsidiarily liable for the labor debts of a motorcycle courier (motoboy) employed by logistics partner SIS Moto Entregas Express Servicos from March 2019 to November 2020. The worker, who had no formal employment contract and worked 11am-to-midnight shifts without breaks under threat of platform blocking, sued after SIS Moto failed to pay owed wages. The court found that because iFood contracts logistics firms whose core activity is providing delivery labor to iFood, this constitutes illegal outsourcing (terceirizacao) rather than a purely commercial relationship, applying STF Theme 725 and TST Sumula 331. iFood's defense -- that its relationship with SIS Moto was purely commercial intermediation -- was rejected; the rapporteur dissented, arguing the platform-logistics relationship is commercial, not an employment arrangement. The ruling conflicts with an April 13, 2026 decision by the TST's Fifth Panel finding iFood NOT liable in a similar case, leaving the court's position on platform liability for outsourced delivery labor unsettled.

Through 2026 iFood progressively rolled out '+Entregas', a scheduled-shift pay model paying roughly R$3.10-3.50 per delivery versus the R$7.50 minimum of the standard model - a cut couriers put at more than 50% per delivery. iFood says adherence is optional and that participating couriers earn more per hour logged; couriers report pressure to join, fewer orders for those who refuse, and mandatory quotas enforced by threat of blocking. Protests and stoppages hit Rio de Janeiro in April 2026 and Florianopolis and Uberaba around August 1, 2026, continuing grievances from the 2025 national app-workers' strike. Worker groups demand a R$10 minimum per delivery and withdrawal of the model.

Attackers gained access to iFood's SIRA portal, an internal system used to respond to judicial, administrative and law-enforcement data requests, via a compromised police account, and gradually extracted data on 1.2 million users between roughly December 2025 and March 2026 to avoid triggering monitoring alerts. iFood publicly disclosed the breach on March 3, 2026, stating there was 'no indication' users needed to change passwords or take additional protective measures. Brazil's national data protection authority (ANPD) said it had not been notified in advance and stated that controllers must adopt preventive measures even amid uncertainty about the scope of risk. Security experts said the exposed data (addresses, phone numbers and CPF national ID numbers) enables sophisticated social-engineering fraud, and that waiving breach notification at that scale was 'legally fragile.'