Szybko data leak: 200,000 customers exposed, company silent for two days

WARSAW — Personal data of about 200,000 customers of the food-delivery app Szybko — names, phone numbers and full order histories — was left openly accessible on an unprotected server. The company said nothing for 48 hours after the leak became public and then issued a four-sentence statement that, critics say, "explains nothing".

Background

Szybko operates in 14 Polish cities, works with 2,300 restaurants and about 4,000 couriers, and has 1.1 million active users. Its brand is built on speed and a friendly tone in social media. The exposed database contained orders going back three years, including delivery addresses, notes such as "door code 4471" and, in some cases, orders from pharmacies.

Who is involved / positions

• Szybko, CEO Paweł Mazur: the statement says the database was "a test environment", that "no payment data was affected" and that the company is "cooperating with the authorities". Mazur has not appeared in public.
• Ola Dąbrowska, independent security researcher, found the server and says she reported it to Szybko eight days before going public — and received no answer.
• The national data-protection authority: has opened proceedings; fines can reach 4% of annual turnover.
• Couriers' group "Kurierzy Razem" (spokesman Damian Sikora): couriers' phone numbers were in the data too, and some already receive threatening calls.
• Angry customers, gathered around the hashtag #SzybkoWyciek, are deleting the app and sharing screenshots of their own orders found in the leak.
• Consumer-rights NGO "Czujny Konsument" (lawyer Ewa Kamińska) is preparing a class action and collecting affected users.
• Competitor Talerzyk offers "a month of free delivery for anyone leaving Szybko".

Timeline of the first three days

• Day 1, 09:00 — Dąbrowska publishes a blog post with redacted screenshots. By evening the story is on major news portals.
• Day 1, 18:00 — the server is taken offline; Szybko says nothing.
• Day 2 — #SzybkoWyciek trends; the authority confirms an investigation; Talerzyk launches its offer.
• Day 3, 09:00 — Szybko publishes its short statement, without an apology. Couriers announce a two-hour strike.

Key facts and numbers

• 200,000 customers, ~4,000 couriers, 3 years of orders.
• 48 hours of silence, 8 days of ignored warnings.
• Potential fine: up to 4% of turnover (turnover last year: 310 million złoty).

What happens next

Szybko's board meets on Day 4. The NGO says 3,000 people have already joined the class action. Journalists are asking whether Mazur will resign.

This material is fictional and was created as an example for a simulation.