iFood says data from 1.2 million users was leaked; see what was affected

Ifood delivery man
Disclosure
iFood confirmed a data leak involving users of the platform, but disputed the scale of the incident reported by some media outlets, which pointed to the possible exposure of information from 43 million people.
In a note sent to g1 this Wednesday (3), the company stated that it found no evidence of a leak on this scale.
Now on g1
According to iFood, the information circulating on the internet is related to an isolated incident recorded in December 2025, which would have been quickly contained by its security protocols.
The company also reported that the scope of the incident was restricted to around 2% of its customer base, a percentage that, according to iFood, is far from the volume of 43 million records mentioned in recent publications.
The company reported that the impact was restricted to around 2% of its user base, equivalent to approximately 1.2 million people.
What data was exposed?
The company states that information such as users' names and CPFs were exposed, but that account access credentials were not compromised.
The company also reported that passwords, payment methods and financial records were not affected by the incident. Furthermore, there is no evidence of access to banking data or information related to transactions carried out on the platform.
In the note, iFood stated that it continues to adopt protective measures and that it acts in compliance with the General Data Protection Law (LGPD).
iFood note in full
iFood did not find any evidence that 43 million user data were leaked. After successive analyses, we identified that the material available on the internet refers to an isolated incident, which occurred in December 2025, and which was quickly neutralized by our security protocols.
The event involved registration data, such as name and CPF, without any compromise of passwords, payment methods or financial records, with an impact restricted to around 2% of our user base.
iFood regrets what happened and reinforces to users that all communications are made only through the platform's official channels.
The security of our community is a priority and we continue to act in strict accordance with the General Data Protection Law (LGPD) to constantly improve our systems."

Source: G1