The threat group ShadowByt3s has claimed responsibility for a new cyberattack on Starbucks, allegedly stealing 10GB of proprietary source code and operational firmware.

The data was reportedly scraped from a misconfigured Amazon S3 bucket named “sbux-assets” as part of a broader campaign targeting cloud vulnerabilities.

A threat actor operating under the moniker “BlackVortex1” posted on a dark web forum claiming to have exfiltrated intellectual property that essentially “makes Starbucks Starbucks”.

The group states they are actively scanning for and exploiting cloud misconfigurations to harvest sensitive corporate data. Cybersecurity monitoring platforms, including VECERT, have flagged this alleged leak circulating on threat intelligence channels as of April 1, 2026.

Compromised Operational Hardware

According to the threat actor’s proof of compromise, the stolen data includes highly sensitive operational technology that functions as the digital controllers for Starbucks’ physical store machines. The leaked files reportedly contain:

Beverage dispenser firmware (.hex files) for core controllers like Siren System components and Blue Sparq motor boards.
Mastrena II espresso machine software, featuring touch-screen interface code and stepper motor configurations.
FreshBlends assets containing proprietary UI packages, ingredient ratios, and pricing logic for automated smoothie stations.

In addition to physical machine firmware, the breach allegedly compromises several of Starbucks’ internal web-based management utilities. The hackers claim to possess source code for a centralized “New Web UI” used to manage machines and hardware across international regions. Other compromised tools include a dedicated inventory management portal (b4-inv) for tracking global supply chain logistics, and operational monitoring utilities used by technicians to assess machine health and performance.

ShadowByt3s has issued an extortion deadline of April 5, 2026, at 5:00 PM, threatening to leak the entire dataset publicly if Starbucks does not pay the ransom.

This alleged intellectual property theft follows closely after a separate security incident disclosed by Starbucks in March 2026, where a credential-harvesting phishing campaign compromised 889 employee “Partner Central” accounts.

While the previous breach exposed staff financial data and social security numbers, this new incident focuses entirely on corporate infrastructure and operational assets.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Starbucks Breach – Attacks Allegedly Claim 10GB of Stolen Source Code appeared first on Cyber Security News.