Alleged Żabka Breach Exposes Sensitive Data, Including Jira Records and Source Code On August 2, 2026, an unknown threat actor listed an alleged data breach of Żabka Polska, Poland’s largest convenience store chain, for sale on a cybercrime forum. The seller, operating under a newly created account, demanded €5,000 for a dataset reportedly containing 541,000 Jira issues, 229,734 IT service-desk tickets, and source code from 89 GitLab repositories. The leak also referenced internal systems, including Żabka’s point-of-sale platform (Nowa Kasa), Cyberstore, zMarket, SAP ERP, and integrations with third-party vendors like Accenture, Netguru, and BlueSoft. Researchers at Ransomnews analyzed a sample of the data and confirmed that the claimed figures largely matched the provided evidence. However, two high-profile numbers 35,206 GDPR (RODO) references and 4,000 bank account mentions were notably absent from the sample, raising questions about their accuracy. The most concerning discovery was a single GitLab access token embedded in all 89 repository dumps, suggesting a potential compromise of Żabka’s entire cs-market platform, including 44 DevOps repositories, 26 backend services, seven frontends, and an API gateway. The repositories also contained live secrets, such as Cloudflare API keys, MongoDB admin passwords, and messaging broker credentials. Żabka has not confirmed the breach, and the company has remained silent on whether it has notified Polish authorities under GDPR’s 72-hour reporting requirement. The timing of the leak is particularly notable, as it surfaced just two days after Alimentation Couche-Tard announced a €7.56 billion acquisition offer for Żabka on July 31. While there is no evidence linking the two events, the leak’s emergence during due diligence could raise legal and security concerns for the buyer. The incident aligns with a growing trend of infostealer malware compromising employee credentials, allowing attackers to exfiltrate data through legitimate access points. The seller’s lack of prior forum activity further complicates verification, leaving the authenticity of the full dataset uncertain. If the GitLab token remains active, the potential for ongoing unauthorized access to Żabka’s codebase and infrastructure could pose significant risks.