Drizly

Disclosed Jul 28, 20202,500,000 affectedSettled

2020 breach exposed 2.5M customers; FTC order binding company and CEO

After a Drizly employee had posted cloud login credentials on GitHub in 2018, a 2020 intrusion exposed data of about 2.5 million consumers. The FTC's 2022 order required Drizly to destroy unneeded data and limit collection, and personally bound CEO James Cory Rellas to security requirements.

What is known

People affected	2,500,000 (as reported by the organization)
Disclosed	Jul 28, 2020
Happened	Jul 2, 2020
Attack	Hacking
Data exposed	Dates of birthEmailsIP addressesNamesPasswordsPhone numbersAddresses
Sector	Retail · US
Status	Settled
Lawsuit or fine	FTC consent order against Drizly and CEO (Oct 2022, finalized Jan 2023); no monetary penalty
Check your email	Have I Been Pwned

Sources

Aggregatorhaveibeenpwned.com

Have I Been Pwned: Drizly

Newsen.wikipedia.org

Drizly (Wikipedia)

Regulatorftc.gov

FTC Takes Action Against Drizly and its CEO

Notices filed

Accounts in the dataJul 28, 2020

Have I Been Pwned2,479,044 people

TotalJul 28, 2020

Research2,500,000 people

History of this record

source_type2026-09-25

aggregator to regulatorby seedSource

source_url2026-09-25

https://haveibeenpwned.com/Breach/Drizly to https://www.ftc.gov/news-events/news/press-releases/2022/10/ftc-takes-action-against-drizly-its-ceo-james-cory-rellas-security-failures-exposed-data-25-millionby seedSource

status2026-09-25

disclosed to settledby seedSource

verified_by2026-09-25

empty to researchby seedSource

verified2026-09-25

0 to 1by seedSource

lawsuit2026-09-25

empty to FTC consent order against Drizly and CEO (Oct 2022, finalized Jan 2023); no monetary penaltyby seedSource

country2026-09-25

empty to USby seedSource

sector2026-09-25

tech to retailby seedSource

attack2026-09-25

unknown to hackingby seedSource

records_basis2026-09-25

hibp to organizationby seedSource

records2026-09-25

2479044 to 2500000by seedSource

summary2026-09-25

In approximately July 2020, the US-based online alcohol delivery service Drizly suffered a data breach . The data was sold online before being extensively redistributed and contained 2.5 million unique email addresses alongside names, physi to After a Drizly employee had posted cloud login credentials on GitHub in 2018, a 2020 intrusion exposed data of about 2.5 million consumers. The FTC's 2022 order required Drizly to destroy unneeded data and limit collection, and personally bby seedSource

title2026-09-25

empty to 2020 breach exposed 2.5M customers; FTC order binding company and CEOby seedSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (Have I Been Pwned), confirmed by Research. Record counts are as reported. Not legal advice.

Everything about Drizly