What You Need to Know about the Panera Bread Data Breach

Panera Bread is a leading American bakery-café fast casual restaurant chain with over 2,000 locations across the United States and Canada. Founded in 1987 as St. Louis Bread Company in Kirkwood, Missouri, the company has grown into one of the nation's most recognizable fast-casual dining brands. Headquartered in Fenton, Missouri, Panera Bread serves millions of customers with its menu of freshly baked breads, sandwiches, soups, salads, and specialty beverages. The company is privately owned by JAB Holding Company and operates as part of Panera Brands, which also includes Caribou Coffee and Einstein Bros. Bagels.

In January 2026, Panera Bread experienced a significant data breach when the notorious cybercrime group ShinyHunters gained unauthorized access to the company's corporate systems. The attackers initially claimed to have stolen 14 million customer records, but subsequent analysis by data breach notification service Have I Been Pwned (HIBP) revealed that the breach exposed personal information for approximately 5.1 million unique accounts. The leaked data includes email addresses, names, phone numbers, and physical addresses, information classified as personally identifiable information (PII).

ShinyHunters published a 760-megabyte compressed archive on its dark web leak site after Panera Bread reportedly refused to pay the group's ransom demand. According to the hackers, they gained access to Panera's systems through a compromised Microsoft Entra single sign-on (SSO) code, making this incident part of a broader voice phishing (vishing) campaign targeting over 100 high-profile organizations across multiple sectors. The attack represents a growing trend of cybercriminals exploiting identity and access management systems rather than targeting individual applications.

While Panera Bread has confirmed the incident to authorities, stating that "the data involved is contact information," the company has not issued public notifications to affected customers as of early February 2026. Security experts warn that even without financial data or passwords, the exposed contact information poses significant risks for follow-on phishing attacks, identity theft, and social engineering schemes.

When Was the Panera Bread Data Breach?

The Panera Bread data breach occurred in January 2026 as part of ShinyHunters' coordinated vishing campaign targeting single sign-on authentication systems at major identity providers, including Okta, Microsoft, and Google. The exact date of unauthorized access has not been publicly disclosed, but the breach became widely known on January 27, 2026, when ShinyHunters added Panera Bread to its Tor-based data leak site alongside other recent victims, including SoundCloud, Crunchbase, and Betterment.

According to cybersecurity researchers, ShinyHunters told media outlets that they gained entry to Panera's corporate network using a Microsoft Entra SSO code, likely obtained through voice phishing tactics. These sophisticated attacks typically involve threat actors impersonating IT support staff or trusted service providers to trick employees into sharing authentication codes, approving login attempts, or providing credentials that grant broad access to internal systems.

The breach follows a warning issued by Okta in December 2025 about an uptick in vishing attacks targeting SSO platforms. Security firm Mandiant also confirmed tracking an ongoing ShinyHunters-branded campaign using voice phishing techniques to steal SSO credentials from numerous organizations. Silent Push threat researchers published findings indicating that ShinyHunters had targeted around 100 organizations and detected active targeting or infrastructure preparation directed at multiple domains in the weeks leading up to the Panera Bread incident.

After Panera Bread reportedly declined to pay the extortion demand, ShinyHunters published the stolen data publicly on January 27, 2026. Have I Been Pwned added the breach to its database on January 31, 2026, confirming that the leaked archive contains 5.1 million unique email addresses along with associated account information. The data breach notification service noted that approximately 77 percent of the email addresses in the breach had previously appeared in other breaches, suggesting that many affected individuals may face increased risk from credential stuffing attacks.

Panera Bread has confirmed the breach to media outlets, notifying federal authorities and engaging cybersecurity experts to assist with the investigation. However, the company has not filed formal data breach notifications with state attorneys general or issued public statements on its website or social media channels as of early February 2026.

How to Check If Your Data Was Breached

Panera Bread has not sent formal notification letters to affected customers as of early February 2026, despite confirming the breach to authorities. If your data was compromised in the incident and Panera eventually issues notifications, you would receive a letter describing the breach, the type of information exposed, and recommended protective steps.

However, there are several proactive ways you can check if your information may have been included in the Panera Bread data breach:

• Use data breach-check websites such as Have I Been Pwned, which has already added the Panera Bread breach to its database. Enter your email address to see if it appears in the leaked data. These services scan known breaches and can reveal whether your information was exposed. Have I Been Pwned confirms that the breach includes 5.1 million unique email addresses, so if you have a Panera account, checking this service is a good first step.
• Monitor your email for suspicious activity or an unusual increase in spam messages. If you suddenly receive a high volume of phishing emails or messages that reference Panera Bread, food delivery services, restaurant rewards programs, or account verification requests, your contact information may have been exposed. Be especially cautious of emails asking you to click links, download attachments, or provide additional personal information.
• Review your financial accounts and credit reports for unauthorized activity. While the breach reportedly did not expose payment card data or banking information, criminals can still use your name, address, and other personal details to attempt fraudulent transactions or open unauthorized accounts. Look for unfamiliar charges, new accounts you did not open, or unexpected inquiries on your credit reports.
• Check for suspicious login attempts on your online accounts, particularly those where you may have used the same email address and password combination. If you receive unexpected password reset notifications, notice logins from unfamiliar locations, or see changed account settings, your credentials may have been compromised or targeted in credential stuffing attacks.

Continue to monitor Panera Bread's official website and communications channels for updates regarding the breach. The company stated it is reviewing the impacted information to determine if formal notifications are required under applicable legal requirements, so official guidance may be forthcoming.

What to Do If Your Data Was Breached

If you believe your information was exposed in the Panera Bread data breach, taking immediate protective action can help minimize potential harm:

• Be extremely vigilant for phishing attacks and social engineering attempts. Because the leaked data includes names, email addresses, phone numbers, and physical addresses, cybercriminals can craft highly convincing fraudulent communications that appear to come from Panera Bread, delivery services, or related businesses. 

Verify the identity of anyone contacting you about your Panera account, rewards program status, or special offers by using alternative communication channels or visiting Panera's official website directly rather than clicking links in emails or messages.

• Enable two-factor authentication (2FA) on all your online accounts where possible, especially those associated with the email address you used for your Panera account. This adds an additional layer of security even if criminals obtain your password. Consider using FIDO2-compliant hardware keys or authentication apps rather than SMS-based 2FA, as text message verification can be vulnerable to SIM swapping attacks.
• Change your passwords immediately, particularly if you use the same password across multiple accounts. Create strong, unique passwords for each account that are at least 12 to 15 characters long and combine uppercase and lowercase letters, numbers, and special symbols. 

Avoid including personal information such as your name, birthday, or address in your passwords. Consider using a reputable password manager to generate and store complex passwords securely.

• Monitor your credit reports closely for signs of identity theft or unauthorized activity. You can request free credit reports from the three major credit bureaus, Equifax, Experian, and TransUnion, and review them for unfamiliar accounts, inquiries, or other suspicious activity. 

Consider placing a fraud alert on your credit file, which notifies creditors to take extra steps to verify your identity before opening new accounts. 

Alternatively, you can place a credit freeze on your credit reports, which prevents new accounts from being opened in your name without your explicit authorization.

• Consider enrolling in an identity monitoring service that can alert you if your personal information appears on the dark web or is being traded illegally. These services provide ongoing surveillance and can help you respond quickly to identity theft attempts. 

Given that approximately 77 percent of the email addresses in the Panera breach had previously appeared in other breaches, affected individuals may face heightened risk from criminals who compile data from multiple sources to build comprehensive profiles.

• Report suspicious activity immediately. If you discover fraudulent charges, unauthorized accounts, or other signs that your information is being misused, contact your financial institutions. Report the incident to the Federal Trade Commission (FTC) at IdentityTheft.gov, and file a report with your local law enforcement agency.
• Review your Panera rewards account for any unauthorized activity. If you have a MyPanera loyalty account, log in through the official website or app to check for suspicious orders, changed account settings, or unusual point redemptions. Change your account password and enable any available security features.

Continue to check Panera Bread's official communications for updates and guidance specific to this incident. As the company completes its review of the impacted information, it may provide additional resources or recommendations for affected customers.

Are There Any Lawsuits Because of the Data Breach?

As of early February 2026, no class-action lawsuits have been publicly filed against Panera Bread specifically for the January 2026 data breach. However, several law firms have announced they are investigating the incident and evaluating potential legal claims on behalf of affected customers.

These investigations typically focus on whether Panera Bread maintained adequate cybersecurity measures to protect customer information, whether the company responded appropriately to the breach, and whether affected individuals are entitled to monetary damages or injunctive relief requiring enhanced security practices. 

Given that the breach exposed personal information for approximately 5.1 million accounts, legal experts suggest that class-action litigation is likely if investigators determine that Panera failed to implement reasonable security safeguards.

The breach may also attract regulatory scrutiny, particularly if Panera's notification timeline or security practices are found to be inadequate under applicable data protection laws. Several states have enacted strict data breach notification requirements that mandate timely disclosure to affected individuals, and failure to comply can result in regulatory investigations and penalties.

Panera Bread's history with data security issues may also factor into any potential litigation. In April 2018, investigative journalist Brian Krebs revealed that Panera's website had leaked millions of customer records, including names, email and physical addresses, birthdays, and the last four digits of credit card numbers. This lasted for at least eight months before the vulnerability was fixed. That incident reportedly exposed data for an estimated 37 million accounts, though Panera initially claimed only 10,000 records were affected. 

The fact that Panera was notified of the 2018 vulnerability by security researcher Dylan Houlihan as early as August 2017 but failed to address it promptly raised concerns about the company's approach to data security.

If class-action lawsuits are filed over the 2026 breach, plaintiffs may point to this history as evidence of a pattern of inadequate security practices or insufficient attention to cybersecurity risks. 

The outcome of any litigation will depend on the specific facts of the case, including evidence about Panera's security measures, the circumstances of the breach, and the extent of harm suffered by affected individuals.

Can My Panera Bread Information Be Used for Identity Theft?

Yes. The information exposed in the Panera Bread data breach can be exploited for various forms of identity theft and fraud. While the breach reportedly did not include payment card data, passwords, or Social Security numbers, the combination of names, email addresses, phone numbers, and physical addresses provides criminals with valuable tools for targeting victims.

With your email address and name, cybercriminals can launch targeted phishing campaigns designed to steal additional sensitive information. Because the breach includes legitimate customer contact information, attackers can craft extremely convincing emails that appear to come from Panera Bread, claiming to offer special promotions, requesting account verification, or warning about security issues. These phishing emails may direct you to fake websites that steal your login credentials, payment information, or other personal details.

Your phone number can be used for vishing (voice phishing) attacks, where criminals call impersonating Panera customer service, rewards program representatives, or even law enforcement investigating the breach. These calls may attempt to trick you into providing additional personal information, account credentials, or payment details under the guise of "verifying your identity" or "securing your account."

The exposed physical addresses can be used to make phishing attempts more convincing by including details that only legitimate companies would know. Criminals may send physical mail that appears to come from Panera or related businesses, or use your address to create fake accounts with other services. When combined with your name and email address, your physical address also helps criminals build comprehensive profiles that can be sold on the dark web or used for more sophisticated identity theft schemes.

Account information and email addresses from the breach can be used in credential stuffing attacks against other online services. Approximately 77 percent of the email addresses in the Panera breach had already appeared in previous breaches, meaning criminals can cross-reference multiple data sets to find email addresses with known passwords or password patterns. If you reused your Panera account password on other sites, attackers may be able to access those accounts as well.

The leaked information may also be used for business email compromise (BEC) attacks targeting corporate customers. If employee email addresses from companies that use Panera's catering services were exposed, criminals could use this information to impersonate Panera staff and send fraudulent invoices or request wire transfers.

Additionally, the exposed data can serve as a foundation for more elaborate social engineering schemes. Criminals may use your contact information to impersonate you with customer service representatives, attempt to reset passwords on your accounts, or convince family members or colleagues to provide additional sensitive information by claiming to be you in distress.

What Can You Do to Protect Yourself Online?

The Panera Bread data breach underscores the persistent cybersecurity risks facing consumers in an increasingly digital world. While you cannot prevent every data breach, implementing strong security practices can significantly reduce your risk of becoming a victim of identity theft or fraud:

• Never reuse passwords across multiple accounts. Each online account should have a unique, strong password that is at least 12 to 15 characters long and combines uppercase and lowercase letters, numbers, and special symbols. Use a reputable password manager to generate, store, and automatically fill complex passwords without having to remember each one individually.
• Enable multi-factor authentication (MFA) on every account that supports it, particularly email, banking, social media, and shopping accounts. Even if criminals obtain your password through a data breach, MFA provides an additional barrier by requiring a second form of verification, such as a code from an authentication app, a biometric scan, or a hardware security key. This is done before granting access.
• Be skeptical of unsolicited communications requesting personal information, account verification, or urgent action. Legitimate companies rarely ask for sensitive information via email, text message, or phone call. 

If you receive a suspicious message claiming to be from Panera Bread or any other company, visit their official website directly (by typing the URL yourself, not clicking links) or call their customer service number from their official site to verify the communication.

• Regularly monitor your financial accounts and credit reports for unauthorized activity. Review your bank statements, credit card transactions, and online account activity at least weekly. Set up transaction alerts through your financial institutions so you receive immediate notifications of charges or transfers. Request your free annual credit reports from all three major credit bureaus and review them carefully for unfamiliar accounts or inquiries.
• Limit the personal information you share online and on social media. The more information available about you publicly, the easier it becomes for criminals to craft convincing phishing attacks or answer security questions to access your accounts. 

Review your privacy settings on social media platforms and adjust them to restrict who can see your posts, contact information, and personal details.

• Use caution when connecting to public Wi-Fi networks for sensitive activities. Public networks at coffee shops, airports, or hotels often lack security measures that protect your data from interception. Avoid accessing financial accounts, entering passwords, or conducting sensitive transactions over public Wi-Fi. If you must use public networks, employ a virtual private network (VPN) to encrypt your connection.
• Keep your devices, software, and applications updated with the latest security patches. Enable automatic updates whenever possible to ensure you receive critical security fixes promptly. Outdated software often contains known vulnerabilities that criminals can exploit to gain access to your devices or data.
• Consider using email aliases or temporary email addresses for accounts with retailers, restaurants, and other non-essential services. Some email providers allow you to create aliases that forward to your main inbox, making it easier to track where spam or phishing emails originate and limiting the exposure of your primary email address in future breaches.
• Enroll in identity theft monitoring services that scan the dark web and notify you if your personal information appears in data leaks, breach forums, or criminal marketplaces. These services provide early warning when your information is being traded or sold, giving you time to take protective action before criminals use it maliciously.
• Educate yourself about current cyber threats and social engineering tactics. Stay informed about recent data breaches, new phishing techniques, and emerging scams by following reputable cybersecurity news sources. Understanding how criminals operate helps you recognize and avoid their tactics.