Starbucks discloses employee data breach after phishing attack hit Partner Central accounts

Starbucks has disclosed a data breach affecting employee accounts after attackers used fake Partner Central login pages to steal credentials. The company says an unauthorized third party accessed certain Starbucks Partner Central accounts after obtaining valid logins through websites that impersonated the real employee portal.

The incident exposed sensitive employee information, including names, Social Security numbers, dates of birth, and financial account and routing numbers. In filings and notification materials, Starbucks says it became aware of the issue on or about February 6, 2026, then launched an investigation with external cybersecurity experts and notified law enforcement.

The breach affected 889 individuals in the United States, including five people in Maine, according to reporting based on the Maine filing and breach notice records. Starbucks also says affected employees can receive 24 months of Experian IdentityWorks identity protection.

What happened

Starbucks says the attackers did not break in through malware or a server exploit. Instead, they used phishing infrastructure that copied the Partner Central sign-in experience, then captured employee credentials and used them to access real accounts. That makes this a credential theft incident tied to social engineering rather than a software vulnerability disclosure.

The affected system, Partner Central, is Starbucks’ internal employee portal for work-related information. Reporting on the notice says the accounts involved were used to manage employment details, personal information, benefits, and HR data.

Starbucks says the attackers had access to affected accounts between January 19 and February 11, 2026. That timeline matters because it gives affected employees a clearer window to review account activity and watch for suspicious financial or identity-related misuse.

Key facts at a glance

What data was exposed

Based on the notice details described in public reporting, the exposed information includes:

• Full names
• Social Security numbers
• Dates of birth
• Financial account numbers
• Routing numbers

This combination creates a serious identity theft risk because it mixes core identity data with banking-related information. People affected should watch not only their credit files, but also direct account activity and unexpected payment changes. That risk assessment follows from the data types listed in the notice.

What Starbucks says it did

Starbucks says it moved quickly after discovering the issue. The company says it investigated the incident, brought in outside cybersecurity experts, notified law enforcement, and strengthened security controls tied to Partner Central account access.

It also says affected employees can enroll in 24 months of complimentary Experian IdentityWorks coverage. Public summaries of the notice say that offering includes credit monitoring, dark web or internet surveillance, identity restoration help, and up to $1 million in identity theft insurance.

What affected employees should do now

• Monitor bank accounts and transaction history closely
• Review credit reports for unfamiliar activity
• Consider placing a fraud alert with a major credit bureau
• Consider freezing credit if the risk feels higher
• Change passwords on any account that reused the same password
• Be cautious with follow-up emails, texts, or calls asking for personal data

These steps line up with the nature of the exposed data and with the response guidance summarized in public breach reporting.

Why this breach stands out

This case shows how effective phishing still is against internal corporate portals, especially when those portals contain payroll, HR, and financial data. Attackers did not need to crack Starbucks’ systems directly if they could convince employees to sign in through lookalike pages.

It also reinforces a larger security lesson. Employee portals that store tax, identity, and banking details need stronger login protections, especially phishing-resistant MFA and better sign-in verification. That is an analytical takeaway based on the attack path Starbucks described.

FAQ