SpeedX Delivery Exposes 840M+ Customer and Driver Records: What Was Reportedly Exposed & What To Do

On April 2, 2026, researchers at Cybernews reported that a Microsoft Azure storage bucket belonging to last-mile delivery company SpeedX was publicly accessible and contained more than 840 million files. The files included customer names, addresses, parcel photographs, driver licenses, and app credentials. SpeedX described the exposure as a configuration error, stated that it found no evidence of unauthorized access, and said the issue had been corrected.

The number of individuals whose records were present in the bucket remains unknown. The incident illustrates how large volumes of operational data can become visible when cloud storage permissions are not restricted.

Breaking down the breach

The exposure was identified through discovery of an unsecured Azure storage container. Researchers found more than 840 million files inside it. The contents listed in the report are customer names, addresses, parcel photographs, driver licenses, and app credentials. No date has been established for when the bucket first became publicly accessible or how long it remained so. SpeedX has not released additional technical details beyond its statement that the exposure resulted from a configuration error and that no unauthorized access was detected.

How a breach like this happens

Publicly accessible cloud storage buckets most often result from misconfigured access controls. In cloud environments, default settings or changes made during development or testing can leave containers readable by anyone with the correct URL. Once the container address is known or guessed, files can be downloaded without authentication. Organizations may not receive alerts when permissions are set too broadly, allowing the condition to persist until an external scan identifies it.

SpeedX and its sector

SpeedX operates as a last-mile delivery service, transporting parcels from distribution points to final recipients. Companies in this sector routinely collect names, physical addresses, and photographic proof of delivery. They also maintain records for drivers, including license information required for employment and regulatory compliance. A large-scale exposure of such records can affect both customers whose movements are documented and drivers whose personal identification is stored.

What was likely exposed

The reported files contained names, addresses, parcel photographs, driver licenses, and app credentials. The exact number of unique individuals represented in the 840 million files has not been disclosed. Organizations of this type commonly hold additional operational data such as order histories, payment references, and internal account details, but the contents beyond the listed categories remain unconfirmed.

Why it matters

Names and addresses combined with parcel photographs can reveal patterns of deliveries to specific locations. Driver licenses provide government-issued identification that can be misused for identity-related activity. App credentials, if still valid, could allow access to accounts containing further personal or operational information. For the company, the incident raises questions about data-handling practices and regulatory obligations that apply to customer and employee records.

Were you affected?

Individuals who used SpeedX services or worked as drivers can check whether their email address appears in known breach data by running a free exposure scan on a reputable breach-monitoring service. If credentials were among the exposed items, changing passwords for any associated accounts and enabling multi-factor authentication where available are immediate steps. Organizations that receive personal data from delivery partners should review whether their own records were included in the exposed files.

AICompiled with AI assistance from public sources and published under our editorial standards.