Sysco, one of the largest food distribution companies in North America, had personal data about 2,691,852 staff and customers published online in June 2026. The data appeared after a ShinyHunters “pay or leak” extortion campaign aimed at Sysco. The data published online is largely corporate contact information, but Sysco’s own notification letters say the affected files also included Social Security numbers for some people.
The exposed data, as listed in the breach catalogue, includes: names, email addresses, physical addresses, phone numbers, employers, job titles, usernames, and customer feedback.
Sysco’s notification letter, dated July 22, 2026 and filed with state regulators, gives more detail. The company became aware of unauthorised activity in parts of its computer environment on April 23, 2026, learned on May 5 that files may have been taken, and determined on June 25 that those files included personal information, including names and Social Security numbers. Sysco has not said how many people received the letter, and it offered them two years of identity protection through Experian.
What this kind of data lets an attacker do
A name plus an email address is enough to send a convincing personalised phishing message. When the attacker also knows your employer and your job title, that message can be aimed at your company specifically, and can imitate a colleague or a supplier. A phone number enables scam calls and scam text messages. A physical address can be used to make a fake letter or invoice look legitimate. Customer feedback, if it is yours, can tell an attacker what you said about Sysco and how to bait you with a follow-up message.
Usernames can be reused. If your Sysco username is the same as one you use on another service, that single piece of information can help someone narrow down where to try next.
Does this touch a small business
Yes, in two ways. If you or anyone on your team placed an order with Sysco, registered for a Sysco account, or filled out a customer survey, your details may be in this set. The data leans toward corporate contact information, so the main risk is a phishing attempt aimed at your business using a real name, a real role, and a real employer. Treat any unexpected email that mentions Sysco, food orders, or a colleague by name with caution.
The indirect risk is similar: even if you never bought from Sysco, a supplier or a staff member in your orbit might appear in the list, and a scammer could use their details to reach you.
What to do this week
- If you received a letter from Sysco, act on it. Enrol in the Experian identity protection it offers, and consider a credit freeze with the three credit bureaus: a Social Security number cannot be changed, so a freeze is the most durable protection.
- Watch your inbox for the next two or three weeks. Any email referencing Sysco, a delivery, an invoice, or an order issue, especially one with links or attachments, is worth pausing on. Verify by contacting Sysco through a number on their official website, not one provided in the message.
- Be sceptical of unexpected calls and texts. A real Sysco representative will not object to you hanging up and calling back through the main number on sysco.com.
- Note which username you used at Sysco. If you reuse that username elsewhere, think about whether those other accounts are protected by more than a password alone.
You can check whether your email appears in this breach on our Sysco breach detail page. If your address shows up, the steps above are the practical first response.
Data from Have I Been Pwned | Sources: Cybernews, IFMA on Sysco’s notification letter | Written with AI assistance and checked against these sources on September 25, 2026
Related
- ShinyHunters in 2026: all 49 companies and how they get in
- Am I Breached? Check an address and get alerts
- Data breach directory
- Same campaign: ShinyHunters and CyrusOne
- Same campaign: ShinyHunters and Neogen