{"id":"panera-bread-customer-data-leak-jan-2026","category":"breach","status":"closed","title":"Panera Bread customer contact data published after failed extortion","tldr":"Attackers published Panera Bread contact data containing 5.1 million unique email addresses, plus names, phone numbers and postal addresses. Watch for personalised scams and check unexpected messages through Panera's app or website.","summary":"Attackers published 14 million Panera Bread records after an unsuccessful extortion attempt, according to Have I Been Pwned. The data contained 5.1 million unique email addresses alongside names, phone numbers and physical addresses; these figures do not establish a total number of affected people. ShinyHunters claimed responsibility and said it used a Microsoft Entra single sign-on code, but that entry method remains an attacker claim in the reports reviewed. Panera's statement, reproduced by Nation's Restaurant News, confirmed access to contact information in a hosted software application and said it had strengthened controls and notified law enforcement. BreachCensus subsequently recorded an April notification filing covering 1,564 Washington residents. As at 3 November, the reviewed sources do not establish that the published data has been recovered or removed, or confirm subsequent scams using it. There is no customer software patch that reverses this exposure.","action":"Be cautious of unexpected Panera offers, refund messages or calls that know your contact details. Check them by opening Panera's app or typing its website address yourself, and never give a caller your password or sign-in code. No device update can undo the publication of this data.","product":"Panera Bread customer contact information","audience":"home","severity":"medium","patch":"na","exploited":true,"cves":[],"tags":["panera-bread","data-breach","customer-data","extortion","shinyhunters"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"news","title":"Panera's emailed statement reproduced in Nation's Restaurant News","url":"https://www.nrn.com/restaurant-technology/panera-krispy-kreme-contend-with-security-breach-lawsuits-as-data-breaches-are-on-the-rise","by":"Nation's Restaurant News","date":"2026-01-30"},{"kind":"research","title":"Panera Bread Data Breach","url":"https://haveibeenpwned.com/breach/Panerabread","by":"Have I Been Pwned","date":"2026-01-31"},{"kind":"news","title":"ShinyHunters claims Panera Bread as stolen credentials victim","url":"https://www.theregister.com/2026/01/27/shinyhunters_claim_panera_bread/","by":"The Register","date":"2026-01-27"},{"kind":"news","title":"Panera Bread breach impacts 5.1 million accounts, not 14 million customers","url":"https://www.bleepingcomputer.com/news/security/panera-bread-data-breach-impacts-51-million-accounts-not-14-million-customers/","by":"BleepingComputer","date":"2026-02-02"},{"kind":"research","title":"Panera, LLC — regulator filing summary, data as at 12 September 2026","url":"https://breachcensus.com/org/panera-llc","by":"BreachCensus","date":"2026-09-12"}],"started":"2026-01-27","closed":"2026-04-16","created":"2026-11-03T21:10:29.833Z","updated":"2026-11-03T21:10:29.833Z","cve_notes":[],"timeline":[{"at":"2026-04-16","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"BreachCensus records a Washington Attorney General filing for Panera affecting 1,564 Washington residents, with an incident start date of 5 January. That state-only figure is not a replacement for the wider leaked-data count.","url":"https://breachcensus.com/org/panera-llc","by":"BreachCensus","patch":null},{"at":"2026-02-02","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"BleepingComputer independently counted roughly 5,120,000 unique accounts in the stolen records. It explained that neither the record count nor the account count establishes how many individual people were affected.","url":"https://www.bleepingcomputer.com/news/security/panera-bread-data-breach-impacts-51-million-accounts-not-14-million-customers/","by":"BleepingComputer","patch":null},{"at":"2026-01-31","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Have I Been Pwned added the breach, recording 5.1 million unique email addresses among 14 million records. It said attackers had published the data after failed extortion, exposing names, phone numbers and physical addresses alongside email addresses.","url":"https://haveibeenpwned.com/breach/Panerabread","by":"Have I Been Pwned","patch":null},{"at":"2026-01-30","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Panera said someone had accessed data in a hosted software application. Its statement said the information involved was contact information, controls had been strengthened and law enforcement had been notified.","url":"https://www.nrn.com/restaurant-technology/panera-krispy-kreme-contend-with-security-breach-lawsuits-as-data-breaches-are-on-the-rise","by":"Nation's Restaurant News","patch":null},{"at":"2026-01-27","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"The Register reported ShinyHunters' claim to have stolen more than 14 million Panera Bread records. The group claimed it gained access using a Microsoft Entra single sign-on code; Panera had not confirmed that account.","url":"https://www.theregister.com/2026/01/27/shinyhunters_claim_panera_bread/","by":"The Register","patch":"na"}],"url":"https://hard.fyi/live/panera-bread-customer-data-leak-jan-2026/","json":"https://hard.fyi/api/live?id=panera-bread-customer-data-leak-jan-2026"}