Travel & Transit Apps · Shipping · Structural / no discrete incident
FedEx
Headline
The 2025 FedEx exposure claimed by attackers (not confirmed by FedEx) was Salesforce-related, which places it inside the campaign documented in the F500 Tech & Semiconductors tab…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
The 2025 FedEx exposure claimed by attackers (not confirmed by FedEx) was Salesforce-related, which places it inside the campaign documented in the F500 Tech & Semiconductors tab: attackers reached more than a thousand organisations through vishing and stolen OAuth tokens rather than any exploit against FedEx itself. Shipping data is quietly revealing - sender, recipient, address, timing and often contents category - and it maps relationships and household composition directly. If the attackers' claim is accurate, a customer who has never heard of Salesforce's integration vendors could have had their address exposed through a chain of vendor relationships.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
SEPARATE, UNRELATED LITIGATION: FedEx Ground has faced lawsuits over the years (some settled; currently pending matters not re-verified Oct 2026) alleging it should be treated as the EMPLOYER or JOINT EMPLOYER of drivers technically employed by third-party 'service providers' — a labor-classification dispute distinct from data privacy, though illustrative of FedEx's broader legal-risk profile. A separate, serious 2022 lawsuit (reportedly settled in 2025; not re-verified this pass) alleged negligent hiring after a FedEx Ground service-provider driver was implicated in a minor's kidnapping and murder.
Data sharing
CLAIMED, UNCONFIRMED 2025 BREACH: the Scattered LAPSUS$ Hunters extortion group claimed (leak site, Aug 31 2025) to have stolen more than 166 MILLION FedEx records from Salesforce, and a database was offered for sale on Oct 3 2025; FedEx had not publicly confirmed the theft as of Oct 10 2025 — one of the largest single-incident record counts found anywhere in this entire 490+ company tracker, though the per-record sensitivity (contact information rather than SSNs/financial data) is comparatively lower than several other major breaches documented elsewhere. This breach is part of the SAME broader 2025 Salesforce-platform attack wave (linked to ShinyHunters/Scattered Spider-style social engineering against Salesforce customer-data instances) that also affected Air France/KLM, Google, Adidas, and numerous other companies documented throughout this tracker.
Fees and billing
Not itemized this pass beyond the above.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (FDX). Service route: c/o General Counsel / Corporate Secretary, Memphis, Tennessee — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy fedex.com/en-us/trust-center/privacy-policy.html | Not fetched yet | NO (HTML only) |
| Terms of service fedex.com/en-us/trust-center/terms-conditions.html | Not fetched yet | NO (HTML only) |
| Website fedex.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: Tennessee. Provisions of TIPA on file:
| Provision | Type | Source |
|---|---|---|
| Enforcement — AG; 60-Day Cure; Treble Damages for Willful Violations Tenn. Code Ann. § 47-18-3313 | hard | source |
| Affirmative Defense — NIST Privacy Framework Alignment Tenn. Code § 47-18-3213 | soft | source |
| Applicability Threshold — Highest Primary Tier (175k) + $25M Revenue Floor Tenn. Code § 47-18-3303 | threshold | source |