Starbucks Corporation, operating as Starbucks Coffee Company, experienced a data breach between January 19, 2026, and February 11, 2026. The company discovered the breach on February 6, 2026, and reported it to the Maine Attorney General on March 12, 2026. The incident involved unauthorized access to employee accounts due to a phishing attack through fake Partner Central login sites. Affected individuals were notified by written letter on March 10, 2026.
The breach exposed names, other personal identifiers, Social Security Numbers (SSNs), dates of birth, addresses, government IDs, medical information, financial account numbers, and routing numbers. A total of 889 individuals were affected, including 5 Maine residents. The remaining 884 affected individuals are implied to be in other U.S. states. The full scope of affected states has not been publicly confirmed.
Details about data breaches can emerge over time, and notification processes may be delayed.