Panera Bread customer contact data published after failed extortion
Attackers published Panera Bread contact data containing 5.1 million unique email addresses, plus names, phone numbers and postal addresses. Watch for personalised scams and check unexpected messages through Panera's app or website.
Be cautious of unexpected Panera offers, refund messages or calls that know your contact details. Check them by opening Panera's app or typing its website address yourself, and never give a caller your password or sign-in code. No device update can undo the publication of this data.
What’s happening
Attackers published 14 million Panera Bread records after an unsuccessful extortion attempt, according to Have I Been Pwned. The data contained 5.1 million unique email addresses alongside names, phone numbers and physical addresses; these figures do not establish a total number of affected people. ShinyHunters claimed responsibility and said it used a Microsoft Entra single sign-on code, but that entry method remains an attacker claim in the reports reviewed. Panera's statement, reproduced by Nation's Restaurant News, confirmed access to contact information in a hosted software application and said it had strengthened controls and notified law enforcement. BreachCensus subsequently recorded an April notification filing covering 1,564 Washington residents. As at 3 November, the reviewed sources do not establish that the published data has been recovered or removed, or confirm subsequent scams using it. There is no customer software patch that reverses this exposure.
- What
- Breach
- Affects
- Panera Bread customer contact information
- Fixed in
- Nothing to patch
- Since
- 27 Jan 2026
- Closed
- 16 Apr 2026
Timeline
- Update
BreachCensus records a Washington Attorney General filing for Panera affecting 1,564 Washington residents, with an incident start date of 5 January. That state-only figure is not a replacement for the wider leaked-data count.
- Update
BleepingComputer independently counted roughly 5,120,000 unique accounts in the stolen records. It explained that neither the record count nor the account count establishes how many individual people were affected.
- Update
Have I Been Pwned added the breach, recording 5.1 million unique email addresses among 14 million records. It said attackers had published the data after failed extortion, exposing names, phone numbers and physical addresses alongside email addresses.
- Update
Panera said someone had accessed data in a hosted software application. Its statement said the information involved was contact information, controls had been strengthened and law enforcement had been notified.
- Made publicNothing to patch
The Register reported ShinyHunters' claim to have stolen more than 14 million Panera Bread records. The group claimed it gained access using a Microsoft Entra single sign-on code; Panera had not confirmed that account.
Sources
- Panera's emailed statement reproduced in Nation's Restaurant NewsNation's Restaurant News · 30 Jan 2026
- Panera Bread Data BreachHave I Been Pwned · 31 Jan 2026
- ShinyHunters claims Panera Bread as stolen credentials victimThe Register · 27 Jan 2026
- Panera Bread breach impacts 5.1 million accounts, not 14 million customersBleepingComputer · 2 Feb 2026
- Panera, LLC — regulator filing summary, data as at 12 September 2026BreachCensus · 12 Sept 2026