Yandex Food

Yandex Food, also known as Яндекс Еды, is a food delivery service operating within Russia as part of Yandex, a major Russian technology company. The platform facilitates online food ordering and delivery, connecting users with restaurants and couriers for meal delivery. As a digital service, it collects and processes personal user information including email addresses, phone numbers, physical delivery locations, and detailed order histories to fulfil its core function. The service is offered under the Yandex brand, which provides various digital solutions in the Russian market. Specific details regarding its operational scale or market position are not provided in the available information. The handling of sensitive personal data positions Yandex Food within the realm of data-intensive digital platforms subject to privacy regulations and cybersecurity risks.

In 2022, Yandex Food experienced two closely related data security incidents that drew substantial attention. In March and April of that year, separate but similar breaches attributed to an employee resulted in the exposure of personal data belonging to over 58,000 users. The leaked information included email addresses, phone numbers, delivery addresses, and order histories, with particular sensitivity arising from the inclusion of data from Russian security services and military personnel who had used official email addresses and delivered to sensitive facilities. These leaks revealed operational details through delivery instructions and prompted investigations into corruption, such as links to luxury properties held by high-profile individuals. Russian authorities responded by attempting to suppress the dissemination of the leaked data, with the communications regulator imposing fines on Yandex and launching a case against the company for inadequate data protection. Public criticism was severe, leading to threats of collective lawsuits and demands for improved cybersecurity measures. Yandex confirmed that financial data and login credentials were not compromised, but the incidents underscored vulnerabilities in internal data access protocols and the potential for misuse of personal information in high-stakes contexts. The events highlighted the challenges faced by digital service providers in safeguarding data against insider threats, especially when handling information from individuals in sensitive roles.