# Szybko data leak: 200,000 customers exposed, company silent for two days

WARSAW — Personal data of about 200,000 customers of the food-delivery app **Szybko** — names, phone numbers and full order histories — was left openly accessible on an unprotected server. The company said nothing for 48 hours after the leak became public and then issued a four-sentence statement that, critics say, "explains nothing".

## Background

Szybko operates in 14 Polish cities, works with 2,300 restaurants and about 4,000 couriers, and has 1.1 million active users. Its brand is built on speed and a friendly tone in social media. The exposed database contained orders going back three years, including delivery addresses, notes such as "door code 4471" and, in some cases, orders from pharmacies.

## Who is involved / positions

- **Szybko**, CEO **Paweł Mazur**: the statement says the database was "a test environment", that "no payment data was affected" and that the company is "cooperating with the authorities". Mazur has not appeared in public.
- **Ola Dąbrowska**, independent security researcher, found the server and says she reported it to Szybko eight days before going public — and received no answer.
- **The national data-protection authority**: has opened proceedings; fines can reach 4% of annual turnover.
- **Couriers' group "Kurierzy Razem"** (spokesman **Damian Sikora**): couriers' phone numbers were in the data too, and some already receive threatening calls.
- **Angry customers**, gathered around the hashtag #SzybkoWyciek, are deleting the app and sharing screenshots of their own orders found in the leak.
- **Consumer-rights NGO "Czujny Konsument"** (lawyer **Ewa Kamińska**) is preparing a class action and collecting affected users.
- **Competitor Talerzyk** offers "a month of free delivery for anyone leaving Szybko".

## Timeline of the first three days

- **Day 1, 09:00** — Dąbrowska publishes a blog post with redacted screenshots. By evening the story is on major news portals.
- **Day 1, 18:00** — the server is taken offline; Szybko says nothing.
- **Day 2** — #SzybkoWyciek trends; the authority confirms an investigation; Talerzyk launches its offer.
- **Day 3, 09:00** — Szybko publishes its short statement, without an apology. Couriers announce a two-hour strike.

## Key facts and numbers

- 200,000 customers, ~4,000 couriers, 3 years of orders.
- 48 hours of silence, 8 days of ignored warnings.
- Potential fine: up to 4% of turnover (turnover last year: 310 million złoty).

## What happens next

Szybko's board meets on Day 4. The NGO says 3,000 people have already joined the class action. Journalists are asking whether Mazur will resign.

*This material is fictional and was created as an example for a simulation.*