Cyber Incident Victim: Home Chef
Date:
Nov 2020
Location:
United States of America
Summary
A threat actor known as ShinyHunters leaked multiple databases, including one belonging to Home Chef, following forum disputes over exclusive data sales. After a buyer alleged ShinyHunters and a broker reneged on an exclusive agreement, the complainant was banned from the forum and retaliated by releasing databases freely on a Russian-language platform. The Home Chef data and others were briefly accessible before being deleted, with the retaliating user's account deactivated shortly thereafter. The incident exposed customer information, though it remains unclear whether all affected entities were initially aware of the breach.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around November 12, 2020, threat actor ShinyHunters was implicated in a series of data breaches involving multiple organizations, including meal delivery service Home Chef. The incident emerged amid public disputes on cybercrime forums regarding the sale and distribution of stolen databases. ShinyHunters and a data broker using the alias "ExpertData" were accused by a forum member of breaching an exclusivity agreement after the member paid tens of thousands of dollars for restricted access to certain datasets. This dispute escalated when the aggrieved buyer was banned from the original forum instead of the alleged scammers, prompting retaliatory action. The banned individual subsequently migrated to a Russian-language cybercrime forum and began distributing multiple databases without charge, including Home Chef’s data alongside those of Eatigo, Peatix, Redmart, Pluto.tv, Storybird, and others. The leaked Home Chef database was among several datasets briefly made available before being deleted, though the precise duration of exposure and number of affected individuals remain unspecified in available reports.
The incident’s impact stemmed from the unauthorized distribution of Home Chef’s database, though neither the specific data types compromised nor the company’s internal detection timeline were disclosed. Media outlets speculated that some affected entities, including Home Chef, might have been unaware of the breach until journalists contacted them for comment following the forum leaks. The retaliatory dump on the Russian forum was short-lived, as the offending user’s account was deactivated within 24 hours of the data release. No confirmed details regarding Home Chef’s response, containment measures, or forensic findings were documented in the source material. The broader event highlighted tensions within cybercriminal ecosystems, where disputes over profit-sharing and exclusivity agreements inadvertently accelerated public exposure of stolen data.