SpeedX Delivery Exposes 840M+ Customer and Driver Records
Cybernews researchers discovered a publicly accessible Microsoft Azure storage bucket belonging to last-mile delivery company SpeedX. It contained over 840 million files including customer names, addresses, parcel photos, and driver licenses. SpeedX stated it was a configuration error with no evidence of unauthorized access and that the issue was fixed.
- names
- addresses
- parcel-photos
- driver-licenses
- app-credentials
A misconfigured Microsoft Azure storage bucket operated by last-mile delivery company SpeedX left more than 840 million customer and driver records publicly accessible, according to researchers at Cybernews. The exposed data included names, physical addresses, parcel photographs, driver’s license images, and application credentials for both customers and contract drivers. SpeedX described the incident as a configuration error, stated there was no evidence of unauthorized access, and confirmed the bucket was secured after discovery.
Public reporting indicates the bucket contained files dating back several years. The data set also included operational details such as delivery routes and timestamps. Cybernews researchers identified the exposure on May 27, 2026, and promptly notified the company. SpeedX responded that the storage container had been left open due to an inadvertent change in access controls and that the issue was corrected immediately upon notification. No logs confirming external downloads prior to remediation have been made public.
Want the rest of this breakdown?
Sign up free to keep reading. Members get extended access, the weekly breach digest, and a complimentary Warden™ to see if their identity is exposed in the breaches we cover.
A breach leaks your credentials. Then hackers chain those credentials to your address, family, phone, and employer using public broker sites. We’re the only tool built around that chain.
⚠ Were you in this breach?
Free email scanner. We check your address against 15.4B+ leaked records (including this breach) in 15 seconds — then show you the $19 cleanup that removes you from the broker sites aggregating leaked data.
Check my email — free →
