Home Chef, the Chicago-based meal kit delivery service owned by Kroger, suffered a data breach in May 2020 when the hacking group ShinyHunters infiltrated its systems through a misconfiguration and exfiltrated records on approximately 8.7 million customers. ShinyHunters subsequently listed the stolen data for sale on dark web marketplaces. The breach occurred while Home Chef was operating under Kroger's ownership, following its 2018 acquisition. The exposed data included customer names, email addresses, phone numbers, geographic locations, IP addresses, the last four digits of credit card numbers, and passwords stored as bcrypt hashes. While bcrypt hashing provides some protection against immediate password cracking, the combination of personal and partial financial data creates meaningful risk. Affected individuals could face phishing attempts, order fraud, and delivery impersonation. Subscription and dietary preference data, if included, may also reveal personal health or lifestyle patterns. Home Chef notified affected customers and prompted password resets following discovery of the breach. No major class-action settlement or regulatory enforcement action specific to this incident has been publicly documented. Affected customers should remain alert to phishing emails that reference their Home Chef account, monitor for any unauthorized charges, and change their password on any other service where they used the same credentials.

Meal-kit platforms collect customer identity, addresses, payment-adjacent data, subscription records, dietary preferences, and order history across recurring food-delivery operations.

Home Chef has continued operating within the Kroger family of businesses. Kroger has integrated Home Chef's meal kits into its retail store footprint through in-store pickup and branded sections, supplementing the direct-to-consumer subscription model. The meal kit category has faced sustained margin pressure. No major standalone Home Chef organizational changes have been prominently reported beyond the Kroger operational context.