---
id: 6569
title: "Hacking Starbucks and Accessing Nearly 100 Million Customer Records"
source_domain: samcurry.net
source_url: "https://samcurry.net/hacking-starbucks"
published_at: "2020-06-20T00:00:00Z"
tags: ["bug-bounty", "access-control", "data-exposure", "api-security", "starbucks", "bff"]
phying_url: "https://phying.com/item/6569"
lang: en
---

# Hacking Starbucks and Accessing Nearly 100 Million Customer Records

## Summary

A Starbucks gift-card purchase tipped Sam Curry to suspicious /bff/proxy/ API calls; probing the backend-for-frontend routing ultimately exposed nearly 100 million customer records.

## Intelligence Metadata

- **Sources:** samcurry.net
- **Published:** 2020-06-20T00:00:00Z
- **Original:** https://samcurry.net/hacking-starbucks
- **Phying News:** https://phying.com/item/6569