Sysco sysco.com Sysco data breach: what happened and what to do
In June 2026 Sysco was targeted in an extortion campaign and data was published. Have I Been Pwned lists 2,691,852 emails of staff and customers with names, phone numbers, addresses, job titles and customer feedback, mostly corporate contact details.
View all 13,115 breaches- Breach date
- 15 Jun 2026
- Made public
- 28 Jun 2026
- Affected
- 2,691,852
- Data exposed
- Customer feedback, Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Sysco is a large food distribution company, and the people in its June 2026 breach are mostly business contacts: staff, and customers who work at restaurants and other food businesses. That changes what the leak means for you.
What happened
According to Have I Been Pwned, Sysco was targeted by a "pay or leak" extortion campaign in June 2026. In that kind of attack, criminals steal data, demand payment, and publish the data if they're not paid. The breach is dated 15 June 2026. The data was published afterwards, and Have I Been Pwned added it on 28 June 2026.
The leaked data held 2,691,852 unique email addresses of staff and customers. Cybernews reported on the campaign and on the scale of the records involved.
What was exposed
The records held email addresses, names, phone numbers, physical addresses and usernames. They also held internal job titles, employer information and customer feedback. Have I Been Pwned describes the contact information as largely corporate.
Corporate data is a different risk from consumer data. There are no payment cards or passwords in the list. What's valuable to criminals is the business context. A real name, a real job title and a real supplier relationship make a convincing fake invoice, a purchase order scam or a message pretending to be Sysco's account team. Business email fraud like this tends to ask for a payment change, which is where real money is lost.
Customer feedback is the odd one out. It can contain details about an order or a complaint, which a scammer can quote back at you to sound legitimate.
What Sysco did
Sysco is a business-to-business company, so most of the people in this leak deal with it at work. Treat any message that claims to come from Sysco about this breach with care, and check it by contacting Sysco through details you already have.
Why extortion breaches keep spreading
In a pay or leak attack, the data is stolen before anyone is asked for money. Paying doesn't undo the theft, and copies keep circulating after publication. Once the list is public, assume it stays public. What you control is how much it can be used against you.
What it means for you
If you work in food service and deal with Sysco, brace for invoice and payment scams that use your supplier relationship. Make a rule that any change to bank details gets confirmed by phone, using a number you already had. If you work at Sysco, expect phishing that looks like an internal message.
If your only link to Sysco is a supplier relationship, the safest habit is also the simplest: nobody changes payment instructions on the strength of an email.
Because the data has no passwords, there's nothing to reset because of this alone.
What to do if you were in it
- 1
Verify any change to payment details by phone
If a supplier or customer asks you to change bank details, call them on a number you already have. Don't use the number in the message.
- 2
Be suspicious of invoices and purchase orders
Names, job titles and supplier relationships were exposed, so scam messages can look routine. Check unexpected invoices against your own records.
- 3
Warn colleagues
If you work in food service or at Sysco, tell the people who handle payments and accounts to expect convincing phishing.
- 4
Turn on two-factor authentication
Add an authenticator app or passkey to your work email and any supplier portals, so a stolen password alone can't open them.
- 5
Check which breaches include your email
Run a free Serus scan to see whether your email or phone number appears in this and other breaches.
Frequently asked
Was I affected by the Sysco breach?
If you were a Sysco employee or customer contact, possibly. Have I Been Pwned lists 2,691,852 email addresses, and you can search yours there or run a free Serus scan.
What was exposed in the Sysco breach?
Email addresses, names, phone numbers, physical addresses, usernames, employers, job titles and customer feedback, largely corporate contact information.
Were passwords or payment cards exposed?
Have I Been Pwned doesn't list passwords or card data for this breach.
What is a pay or leak attack?
Criminals steal data, demand payment, and publish it if the company refuses. The data is already stolen when the demand is made.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
