Massive SpeedX Data Leak: 840 Million Delivery Records Exposed

Summary

SpeedX, an American last-mile delivery provider, has allegedly exposed 840 million records through a misconfigured Azure Blob Storage bucket. The leaked data includes U.S. customer addresses, package photos, and images of couriers’ driver’s licenses, impacting users of major platforms such as Shein, Temu, and Amazon.

What happened?

Security researchers from Cybernews discovered that a SpeedX storage bucket was publicly accessible without any password protection. By using a simple bucket name lookup, they were able to access approximately 840 million files. While SpeedX acknowledged that data was accessible, they denied any “malicious” unauthorized access occurred. However, researchers confirmed the ease with which sensitive PII could be retrieved.

Why it matters

This incident highlights the significant risks associated with data handling in the logistics sector. As a partner for e-commerce giants like Amazon, Shein, and Temu, SpeedX’s failure puts millions of consumers at risk of phishing and identity theft. The exposure of driver’s license photos is particularly concerning, as these can be used for fraudulent activities and identity spoofing.

Evidence

Research Report: Cybernews confirmed accessibility to 840 million files via an unsecured Azure bucket.
Data Scope: Researchers documented findings of PII, including addresses, signatures, and government-issued IDs.
Company Response: SpeedX confirmed the vulnerability after being contacted by researchers but downplayed the potential impact.

Analysis

The discrepancy between SpeedX’s official statement and the researchers’ findings suggests a lack of robust cloud security protocols. A misconfiguration of this scale is hard to justify in 2026, especially when handling highly sensitive documents like driver’s licenses. The intersection of supply chain logistics and cloud storage continues to be a critical vulnerability for data privacy.

Practical Takeaways

For Customers: Be extremely vigilant regarding unexpected messages or calls related to package deliveries. Enable multi-factor authentication whenever possible.
For Partners: Platforms like Amazon and Temu must subject their logistics partners to more rigorous security audits to protect customer data.
For Logistics Firms: Cloud storage configurations should undergo frequent, automated security checks and permission reviews.

Open Questions

Were the records actually downloaded by malicious actors before the bucket was secured?
What legal consequences will SpeedX face under the California Consumer Privacy Act (CCPA) or other U.S. data protection laws?