Mercato left a cloud bucket open, spilling 70,000 orders — and stayed quiet

Mercato, founded in 2015, helps over a thousand smaller grocers and specialty food stores sell online for pickup or delivery across Boston, Chicago, Los Angeles and its home New York. In January 2021, one of its cloud storage buckets on Amazon's cloud was left open and unprotected, exposing tens of thousands of customer orders, TechCrunch reported. The company fixed the spill but had not alerted its customers, and TechCrunch could find no disclosure notices to state attorneys-general where required by law.

The exposed data set contained more than 70,000 orders dating from September 2015 to November 2019: customer names, email and home addresses, order details, and the IP address of the device used to place each order. It also included personal data and order details of Mercato's own executives. TechCrunch verified a portion of the records by matching names and addresses against known accounts and public records. Storage buckets on Amazon's cloud are private by default, so it wasn't clear how the bucket opened or when Mercato learned of the exposure.

The timing compounded the problem: California alone had more than 1,800 residents in the data set — over three times the number that triggers mandatory breach disclosure under state law — yet no notices appeared. It was also unknown whether Mercato told investors before closing a $26 million Series A led by Velvet Sea Ventures earlier that month; the lead investor did not respond to comment requests. CEO Bobby Brannigan confirmed the incident but declined questions, citing an ongoing investigation.

Over 70,000 orders with names, home addresses, emails and IP addresses exposed; no breach notices published where state law required them.

Years of order records — including executives' own — sat in a bucket with public access, the most basic cloud misconfiguration there is.

The spill went unfixed for years' worth of data (2015–2019 orders) and undisclosed for months: January exposure, April report, no customer notice.

California's disclosure threshold was exceeded threefold, so the absence of notices to the state attorney-general was itself a compliance failure.

The company raised $26 million in the same window without any public sign investors were told, stacking a fundraising deadline on top of a security lapse.

Cloud buckets are private by default for a reason — and fixing a spill the week you close a round, without telling the people spilled on, doubles the mistake.

Brannigan said Mercato was 'conducting a complete audit using a third party,' promised to contact affected individuals, expressed confidence that no credit card data was accessed because card details aren't stored on its servers, and pledged to keep 'all authoritative bodies and stakeholders, including investors' informed of the audit's findings. TechCrunch's questions about disclosure went unanswered, and no state notifications had been published as of the report.