Foodpapa.pk Allegedly Breached, 239,109 Accounts Reportedly Exposed
Summary
A report says a January 2026 backup of Pakistani food delivery platform Foodpapa[.]pk was uploaded to a dark web forum, allegedly exposing 239,109 customer, driver, and administrator accounts and personal and authentication data.
Key points
- The article alleges that a January 2026 backup of Foodpapa[.]pk was uploaded to a dark web forum; it provides no independent confirmation.
- The reportedly affected 239,109 accounts include 217,000 customers, 22,000 delivery personnel, and 109 administrators.
- The data reportedly includes names, phone numbers, email addresses, CNIC numbers, home addresses, and vehicle registration details.
- Authentication data reportedly includes bcrypt password hashes, JWT and Firebase tokens, refresh tokens, and API credentials.
Article Details
- Victim Organization
- Foodpapa.pk
- Victim Domain
- Foodpapa.pk
- Incident Type
- Alleged data breach involving a January 2026 backup reportedly uploaded to a dark web forum
- Data Types Exposed
- User IDs
- Full names
- Phone numbers
- Email addresses
- Bcrypt password hashes
- JWT authentication tokens
- Firebase tokens
- Refresh tokens
- API credentials
- CNIC numbers
- Home addresses
- Father names
- License plates
- Vehicle registrations
- Affected Records
- 239,109 accounts reportedly affected: 217,000 customers, 22,000 delivery personnel, and 109 administrators.
- Affected Data Size
- Not disclosed
- Operational Impact
- None reported
- Ransom Or Extortion
- None reported
- Claim Status
- alleged