very organisation has an internal portal — the one employees use to check pay stubs, update bank details, manage benefits. Now imagine someone builds a pixel-perfect copy of that portal. Your employees Google "partner login help" and the fake site ranks above the real one. They click. They enter their credentials. Their Social Security numbers, bank accounts, dates of birth — gone. No malware needed. No servers breached. Just a convincing fake and a search engine. This is exactly what happened to 889 Starbucks employees. But our threat intelligence investigation uncovered something far worse — and it could be happening to your organisation right now.
Executive Summary
In March 2026, Starbucks disclosed a breach affecting 889 Partner Central accounts. Our threat intelligence investigation reveals this was not an isolated incident but the culmination of an 18-month multi-vector campaign:
- ~3,800 Partner Central SSO credentials circulating in dark web stealer logs — 4x the disclosed number
- 19+ phishing domains impersonating Starbucks employee portals, registered by operators across multiple countries
- A shared phishing infrastructure hosting fake portals for Starbucks, Walmart, Charles Schwab, KeyBank, and 12+ other brands
- Dark web evidence of Starbucks being targeted since October 2024 — 18 months before disclosure
By the Numbers
What Happened
Starbucks employees — known internally as "partners" — use Partner Central, an internal HR portal, to manage payroll, benefits, tax documents, and personal information. Between January 19 and February 11, 2026, threat actors deployed fraudulent websites mimicking the Partner Central login page.
Employees directed to these fake sites unknowingly entered their credentials, which were captured via adversary-in-the-middle (AiTM) proxying and used to access real accounts. The phishing pages were pixel-perfect replicas of the legitimate portal — complete with Starbucks branding, navigation menus, and partner resource links.
Starbucks detected suspicious activity on February 6 but took 5 additional days to fully remove attackers from affected accounts. In total, 889 accounts were confirmed compromised.
Data exposed included: full legal names, Social Security numbers, dates of birth, and bank account and routing numbers.
Per Starbucks' filing with the Maine Attorney General (March 12, 2026): 889 individuals affected, 5 in Maine. The company offered affected partners 24 months of identity protection and credit monitoring services.
Social Security numbers and bank account details cannot be rotated like passwords. The 889 affected employees face permanent identity theft risk — these data points will circulate in criminal marketplaces indefinitely.
Data Exposed
Attribution Analysis
TTPs Consistent With: Payroll Pirates (Storm-2657)
- Systematic targeting of HR and payroll portals — across education, retail, and healthcare sectors
- AiTM phishing infrastructure using pixel-perfect login page clones that proxy real-time authentication
- Financial motivation — harvesting SSNs, bank details, and payroll information for identity fraud and direct financial theft
- Preferred registrar patterns matching known Storm-2657 infrastructure
- Google Ads malvertising to drive employees searching for schedule and payroll portals to fake login pages
Starbucks has not publicly attributed this breach. This assessment is based on TTP analysis and infrastructure pattern matching.
Attack Timeline
The Starbucks Partner Central breach was not a single event. Our investigation traces adversary interest back 18 months, revealing a pattern of escalation.
DDoS attack on starbucks.com by hacktivist group. First sign of Starbucks as an active target — probing phase.
Admin access to Starbucks' Atlassian instance sold on dark web forum for $1,000. Jira and Confluence contain internal documentation, architecture details, and sometimes credentials.
Threat actor on Telegram threatens to leak full Starbucks database covering all global branches. Sustained adversary interest — months before the disclosed breach.
Infostealer credential harvesting — 6,100+ corporate stealer logs accumulate across Starbucks domains over 18 months.
Phishing attack begins — fake Partner Central login pages deployed via AiTM proxying.
Starbucks detects suspicious activity. 18 days after the attack began.
Attackers fully removed from compromised accounts. 5 days after detection.
Breach notification letters sent to 889 affected partners.
Filed with Maine Attorney General. 889 individuals affected, 5 in Maine.
Infostealer activity targeting Starbucks portals is STILL ONGOING. New stealer logs containing Partner Central credentials are appearing daily.
The Dual Attack — Phishing Meets Infostealers
This breach is the product of two convergent attack vectors, not one. The disclosed breach (889 accounts via AiTM phishing) is only the visible component. Running in parallel — and still active — is a far larger infostealer campaign silently harvesting credentials from partner devices.
Vector A: AiTM Phishing — Fake login pages proxied real-time authentication to capture credentials and session tokens. This is the 889-account breach Starbucks disclosed.
Vector B: Infostealer Malware — Malware running on partner devices silently exfiltrated saved browser credentials. ~3,800 Partner Central SSO credentials found on dark web — a completely separate vector targeting the same portal.
Dual Attack SVG DiagramDark Web Credential Exposure
Our dark web monitoring flagged a staggering volume of Starbucks-related credentials circulating across underground marketplaces — spanning both consumer-facing and corporate infrastructure. These numbers reflect what our platform detected at the time of this investigation.
Most Targeted Starbucks Subdomains
Compromised Device Analysis
Our team retrieved full device dumps from the most critical stealer logs affecting Starbucks. Each dump reveals the complete credential inventory stolen from a single infected device. Below are two anonymized cases from our analysis.
Device A — "Most Breach-Relevant"
Key services compromised:
Device B — "Massive Exposure"
Key services compromised:
Phishing Domain Network
Our anti-phishing and brand monitoring identified 19+ domains impersonating Starbucks Partner portals — currently active or recently active. These are not crude fakes. They are fully developed content sites built to rank in search engines and mimic the real portal.
- Registered by operators across multiple countries using bulk registrars
- One domain created March 11, 2026 — the day before Starbucks filed with the Maine AG
- Same operator also runs fake employee portals for another major logistics company
- Pages rank in search engines for "Starbucks Partner Hours login" and similar queries
- Content includes detailed guides on schedules, W-2 forms, pay stubs, 401k — building trust before credential harvesting
Shared Infrastructure Discovery
When we mapped the infrastructure behind the Starbucks phishing domains, we found something bigger. These domains are part of a shared attack platform — the same servers host campaigns targeting major retailers, financial institutions, and enterprise services simultaneously.
- Multiple phishing domains targeting different brands resolve to the same server cluster
- All servers run an identical software stack
- Connected via a common DNS provider and redirect hub
- Brands targeted on the same infrastructure: Starbucks, Walmart, [Major Bank], [Investment Firm], [Insurance Company], Microsoft SharePoint, and others
- The infrastructure pattern points to a phishing-as-a-service operation or a single coordinated group running campaigns against 12+ brands
Dark Web Threat Evidence
Our dark web and Telegram monitoring captured the following threat activity targeting Starbucks — all predating the disclosed breach by months.
September 2025: A threat actor on Telegram threatens to leak a full Starbucks database covering all global branches. Sustained adversary interest — months before the disclosed breach.
The Uncomfortable Math
889 accounts breached via phishing.
~3,800 credentials already on the dark web via infostealers.
19+ fake domains ranking in search engines right now.
Stealer logs still appearing as of this publication.
Starbucks disclosed 889. The real exposure is 221,000+.
The disclosed breach was the tip. The question every CISO should be asking is not "could this happen to us?" — it's "has it already happened and we just don't know yet?"
Where Continuous Monitoring Makes the Difference
Every stage of this 18-month campaign left signals. Here is where each one could have been caught:
Dark web access sale detected (Atlassian admin for $1,000) → access revoked, Atlassian hardened — DARK WEB MONITORING
~3,800 Partner Central credentials identified in stealer logs → passwords force-rotated, dead credentials — DARK WEB MONITORING
Clone phishing sites detected via domain monitoring → domains taken down before credential harvesting — ANTI-PHISHING & BRAND PROTECTION
Anomalous login patterns flagged → contained in hours, not 5 days — SOC
Stolen data tracked on dark web marketplaces → impact mitigated, affected users alerted immediately — BRAND MONITORING & DIGITAL RISK
The Rewind — Same Attack, With Monitoring
Four Layers. Four Chances. Any One Is Enough.
Anti-phishing monitoring identifies and takes down clone sites within hours of registration → No credentials are harvested. The attack fails at the first step.
Dark web credential monitoring detects Partner Central SSO credentials in stealer logs → Exposed passwords force-rotated across all affected accounts before attackers can use them.
SOC integration detects anomalous login patterns (new IPs, impossible travel, credential stuffing) → Breach contained in hours, not 5 days. Exposed accounts: dozens instead of 889.
Attack surface monitoring flags that Partner Central lacks phishing-resistant MFA (FIDO2/WebAuthn) → MFA hardened before the attack, making AiTM proxying ineffective.
Four layers. Four chances. Any one is enough.
MITRE ATT&CK Mapping
Mitigation Guidance
Identity & Access Hardening
Continuous Monitoring
This Is Not an Isolated Incident
This is a story about an organisation systematically targeted across multiple vectors over 18 months — with the phishing breach being the moment it became visible. DDoS probing. Dark web access sales. Infostealer credential harvesting. Phishing domain registration. And finally, the attack itself.
Every signal was there. Every signal was missed. The disclosed breach affected 889 accounts. Our investigation shows the true exposure is at least 4x larger. And it is not over.
Right now, infostealer logs are being traded on dark web forums. Some contain credentials to your HR portal. Some contain your employees' banking details. Some were logged today.
The question is not if — it's when they do, will anyone be watching?
Don't Wait for the Breach Notification
Starbucks' employees found out their SSNs were stolen 32 days after attackers were removed — and more than two months after the attack began.
Our continuous monitoring works across the entire attack lifecycle. Because by the time that letter arrives, it's already too late.
Learn More About Our ServicesSources
- Maine Attorney General — Starbucks Corporation Breach Filing (March 12, 2026)
- Starbucks Corporation — Breach Notification Letter to Affected Partners
- Starbucks Corporation — Q1 FY2026 Earnings (41,118 stores, 90 markets)
- Storm-2657 / Payroll Pirates — Published Threat Intelligence Reports (October 2025 – March 2026)
- Starkiller PhaaS — AiTM Reverse Proxy Phishing Framework Analysis (February 2026)
- MITRE ATT&CK — Referenced Technique IDs
- TechOwl Threat Intelligence — Dark Web Monitoring and Credential Exposure Analysis
TechOwl SHIELD
Continuous Threat Intelligence & Digital Risk Protection
Dark Web Monitoring · Anti-Phishing · Attack Surface Monitoring · SOC · Brand Protection
