iFood—iFood data breach exposed 1.2 million users' personal data via compromised law-enforcement request portal, downplayed risk and delayed notification
Attackers gained access to iFood's SIRA portal, an internal system used to respond to judicial, administrative and law-enforcement data requests, via a compromised police account, and gradually extracted data on 1.2 million users between roughly December 2025 and March 2026 to avoid triggering monitoring alerts. iFood publicly disclosed the breach on March 3, 2026, stating there was 'no indication' users needed to change passwords or take additional protective measures. Brazil's national data protection authority (ANPD) said it had not been notified in advance and stated that controllers must adopt preventive measures even amid uncertainty about the scope of risk. Security experts said the exposed data (addresses, phone numbers and CPF national ID numbers) enables sophisticated social-engineering fraud, and that waiving breach notification at that scale was 'legally fragile.'
Scoring Impact
| Topic | Direction | Relevance | Contribution |
|---|---|---|---|
| Consumer Protection | -against | secondary | -0.50 |
| Data Security | -against | primary | -1.00 |
| Overall incident score = | -0.664 | ||
Score = avg(topic contributions) × significance (high ×1.5) × confidence (0.59)
Evidence (2 signals)
Security experts and ANPD say iFood's breach risk assessment was 'legally fragile'
Times Brasil/CNBC reported security expert Marcelo Branquinho warning that the leaked CPF, address and phone data enables refined social-engineering fraud, and cited ANPD's statement that controllers must adopt preventive measures even amid uncertainty about breach scope.
iFood confirms data breach of 1.2 million users via compromised internal law-enforcement request portal
CNN Brasil, Estadao and O Globo reported iFood confirmed on March 3, 2026 that attackers used a compromised police account to access its SIRA portal and extracted data on 1.2 million users over roughly three months, while ANPD said it had not been notified in advance.