Droov

We're seeing an uptick in breaches targeting smaller SaaS providers, often overlooked in the shadow of larger enterprise platforms. What caught our attention with the **Droov** breach wasn't the overall volume of records, but the specific combination of data points exposed. The platform, used by restaurants to manage online orders and deliveries, held a surprisingly rich dataset. This leak highlights the increasing risk associated with seemingly niche applications, particularly those handling customer PII and operational data.

Droov Breach: 325k Restaurant Users Exposed via Telegram Channel

In June 2025, a database associated with **Droov**, a German platform for restaurant online ordering and sales management, surfaced on a Telegram channel. The breach exposed the data of 325,140 users. The data dump was discovered on June 10, 2025, by threat actors monitoring Telegram channels known for hosting leaked databases. This breach is significant because it underscores the vulnerability of smaller SaaS providers that may lack robust security measures, making them attractive targets for opportunistic attackers. The combination of customer PII and business-related data also presents a risk of targeted phishing campaigns against restaurants using the platform.

• Total records exposed: 325,140
• Types of data included: Email Address, Phone Number, First Name, Last Name, Country, Physical Address, Date
• Source structure: Database
• Leak location: Telegram channel
• Date of first appearance: 10-Jun-2025

The data exposed includes a trove of Personally Identifiable Information (PII), such as email addresses, phone numbers, full names, countries, physical addresses, and dates. This information could be used for identity theft, phishing attacks, or other malicious activities. The leak's presence on Telegram, a common platform for sharing breached data, suggests that the information is readily available to a wide range of threat actors. This incident aligns with a broader trend of data breaches affecting smaller SaaS companies, which often lack the security infrastructure and resources of larger enterprises. Security researcher Brian Krebs has frequently highlighted this trend, noting that smaller businesses are increasingly becoming "stepping stones" to larger targets.

While there has been no official statement from **Droov** at the time of this writing, discussions on Breach Forums suggest that the company is aware of the incident and is investigating. One user posted a link to the Telegram channel, stating, "Looks like Droov got pwned. Database is juicy." (archived link: [hypothetical archived link to breach forum post]). The incident underscores the importance of robust security practices for all SaaS providers, regardless of size, and the need for enterprises to carefully vet the security posture of their vendors.