Drizly 2020 Data Breach
Platform · Alcohol delivery services · E-commerce + logistics marketplace · USA
Drizly Alcohol Delivery App Breach (2020): 2.5 Million Customer Records Including Passwords, DOB & Home Address Exposed
Alcohol delivery marketplace.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
17/100
Lower riskHigher risk
Lower: limited current risk based on data value and recency.
Data Sensitivity i
StandardExposed data is largely lower-sensitivity. Standard identity-protection precautions are advised.
2.5MRecords
2020Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
AddressPhysical address
Breach Summary
Drizly, an online alcohol delivery service operating across dozens of U.S. cities, suffered a data breach in approximately July 2020 that exposed the personal information of 2.5 million customers. How attackers gained access was not publicly disclosed. The stolen data was sold online and subsequently redistributed widely, making containment effectively impossible. Affected customers had their names, email addresses, phone numbers, physical addresses, IP addresses, dates of birth, device information, and passwords exposed. The passwords were stored as bcrypt hashes, a format that slows but does not prevent cracking. The combination of home addresses, dates of birth, and account credentials creates a high risk of phishing, fraud, account takeover, and impersonation-based scams. The Federal Trade Commission investigated and found that Drizly's CEO, James Cory Rellas, had been warned about the underlying security vulnerability two years before the breach and did not act. In January 2023, the FTC finalized a consent order against both Drizly and Rellas personally. The order follows Rellas for ten years: any future company he leads that holds personal data on more than 25,000 people must implement a formal security program. The order also required Drizly to delete unnecessary data and restricted what it could collect going forward. For affected individuals, the risk remains active. Exposed data circulates indefinitely once redistributed, and the personal details involved are enough to support targeted fraud or identity theft years after the original breach.
Full threat analysis, exploitation vectors, and principal guidance below.
10 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
2.5M records analyzed
About Drizly
Drizly was an alcohol delivery marketplace. Local retailers listed their inventory. Consumers ordered. Drizly handled the transaction. The company operated in dozens of U.S. cities before Uber acquired it in 2021 for approximately $1.1 billion. Uber shut it down in March 2024 and folded alcohol delivery into Uber Eats.
Why They Hold Your Data
Alcohol delivery platforms collect identity, age-related verification data, addresses, phone numbers, device information, and purchase-linked account records for delivery and compliance purposes.
Recent Developments
Drizly is gone. The app no longer exists. But the regulatory record outlasted the company. That is the story worth knowing here.
Data Points Exposed
8 verified field types
Date of Birth High
Device Information
Email Address
Full Name
IP Address
Password High
Phone Number
Physical address High
Breach Impact
The FTC found that Drizly's CEO, James Cory Rellas, had been warned about the security vulnerability two years before the 2020 breach. He did not act. In January 2023 the FTC finalized a consent order against both the company and Rellas personally. The order follows him for ten years. Whatever company he leads next, if it holds personal data on more than 25,000 people, he is legally required to implement a security program. The FTC specifically prohibited SMS-based authentication. It required data deletion. It required restricted collection going forward. FTC Chair Lina Khan said: protecting Americans' data is not discretionary. The case is taught now as an example of what executive accountability can actually look like.
Exploitation & Downstream Threats
• Credential stuffing against reused passwords across other platforms | • Identity verification bypass using name + date of birth combination | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure
Principal Risk Advisory
What this means for a principal
A consumer-service breach: contact and account data supports phishing, account takeover and profile enrichment. For a high-profile principal this is targeting-grade, not merely identity-theft-grade: the combination lets an adversary locate, impersonate, or pressure the principal with little additional work.
What You Should Do
- Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
- Reset any reused passwords and enable MFA on email first, then financial accounts.
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation