Yandex Food, a Russian food delivery service operated by internet giant Yandex, suffered a data breach in February 2022 when an insider, reportedly a disgruntled employee, exfiltrated and published a large dataset online. The leak exposed approximately 49.4 million delivery orders. Yandex confirmed the incident. The exposed data included customers' full names, phone numbers, physical delivery addresses, and delivery instructions. This combination is particularly sensitive because it reveals where people live, their routines, and when they are likely to be home. For ordinary customers, this creates a real risk of delivery scams, phishing calls, and physical targeting based on inferred habits and residence. No formal regulatory enforcement action has been documented in publicly available sources. The dataset circulated online and was used by investigative journalists and open-source researchers to map the movements of Russian officials and sanctioned individuals, raising its public profile considerably. For affected individuals, the primary ongoing risks are unsolicited contact, fraud attempts, and the exposure of home address information to anyone who accessed the published data.

Food-delivery platforms collect user accounts, phone numbers, addresses, order history, payment-adjacent records, and location-linked delivery data tied to commerce and logistics services.

Yandex has undergone significant corporate restructuring following sanctions imposed after Russia's 2022 invasion of Ukraine. The company divested several international operations and reorganized its Russian assets. The food delivery service has continued operating in Russia under modified branding. Western partnerships and expansion plans were curtailed by the sanctions environment.