Coca Cola

Our investigation team has indexed a data breach listing tied to Coca-Cola, with an estimated attack date of May 31, 2023. The listing contains 1,575 records of personal information, most of it the kind of data commonly held in employee or personnel files: names, home addresses, and what appear to be Social Security numbers. No ransomware group or individual hacker has publicly claimed responsibility for this listing, and we found no company notice confirming the incident.

Limited public reporting: As of September 25, 2026, detailed company notices or major news coverage for this listing were limited in sources reviewed. The facts below rely primarily on the indexed fields plus any secondary sources cited.

Coca-Cola has faced multiple security claims and incidents in recent years, including a 2022 extortion claim by a group calling itself Stormous and a confirmed data theft at its bottling affiliate Coca-Cola FEMSA in 2023. Because our team cannot verify which, if any, of those incidents corresponds to this listing, we describe only what the indexed data shows and flag what remains unconfirmed.

What Information Was Compromised?

Our analysis found the following data types in this breach: 1,575 records containing names and home addresses, 1,571 records containing Social Security numbers, and 373 records containing email addresses.

Not every individual is affected by every type of data listed here.

The concentration of names, home addresses, and Social Security numbers suggests personnel-style records rather than customer accounts, though the indexed fields alone cannot confirm who the affected individuals are or how the data was obtained.

What Are the Potential Risks for Affected Individuals?

A Social Security number paired with a full name and home address is among the most dangerous combinations of personal data to have exposed. With those three pieces of information, a criminal can attempt to open credit accounts, file fraudulent tax returns, apply for loans or government benefits, or impersonate someone to service providers.

Unlike a leaked password, a Social Security number cannot be changed. Affected individuals may face identity theft risks that surface months or even years after a breach, often discovered only when a loan application is denied, an unfamiliar account appears on a credit report, or a tax filing is rejected because someone else already used the person's identity.

Home address exposure carries additional risks, including targeted phishing by mail, scams referencing real personal details to appear credible, and, in some cases, physical safety concerns.

What Should You Do If You Were Affected?

If you believe your data may be part of this breach, several practical steps can reduce your risk:

Place a fraud alert or credit freeze with the three major credit bureaus, Equifax, Experian, and TransUnion. A freeze is free and blocks most new credit accounts from being opened in your name.

Monitor your credit reports at annualcreditreport.com and review them for accounts or inquiries you do not recognize.

Watch for phishing. Criminals who hold real names, addresses, and email addresses often craft convincing scams. Be skeptical of unexpected emails, calls, or letters that reference personal details.

Guard against tax fraud. File your tax return early when possible, and respond promptly to any IRS notice about a duplicate or suspicious return.

Consider an Identity Protection PIN from the IRS, which prevents anyone from filing a return using your Social Security number without the PIN.

Because Social Security numbers cannot be replaced, ongoing vigilance matters more than a single response. If you see signs of identity theft, report it to the Federal Trade Commission at IdentityTheft.gov and to your local police if requested by creditors or agencies.

We will update this article if Coca-Cola issues a public notice about this listing or if additional verified details emerge.