Instacart, the U.S. grocery delivery marketplace, had customer data stolen and published by a threat actor calling itself "Scattered LAPSUS$ Hunters" as part of a broader attack campaign targeting Salesforce cloud environments in 2025. The breach affected 39.3 million records. The group released a sample of the stolen database on October 3, 2025, with the full dataset reportedly scheduled for public release on October 10, 2025. Instacart was one of more than 30 brands confirmed to have had customer data exposed in the same campaign. The exposed data includes full names, email addresses, phone numbers, and full mailing addresses, along with Instacart account details such as account type, shopper status, shopper IDs, subscription tier, and regional warehouse assignments. This combination of contact and account data is particularly sensitive because it links personal identifiers to home addresses and shopping behavior, which can reveal household routines, family composition, and consumer habits. Instacart's public response to this specific incident has not been extensively documented. Affected individuals face real risks from phishing attacks, delivery impersonation scams, and targeted fraud. Anyone who receives unexpected communications from parties claiming to represent Instacart should treat them with caution, verify through official channels, and watch for unsolicited contact referencing their address or order history.

Grocery-delivery platforms collect customer identity, phone numbers, addresses, payment-adjacent data, order history, and delivery interactions across e-commerce and logistics workflows.

Instacart went public in September 2023 and has spent the period since navigating the transition from high-growth startup to public company with investor pressure on profitability. The company has continued building out its advertising business as a higher-margin revenue stream. It has also expanded retailer partnerships and invested in faster delivery infrastructure. Financial performance has been a focus of public reporting, with Instacart managing competition from DoorDash, Uber Eats, and in-house delivery services operated by major grocery chains.