McMenamins data breach: what happened and what to do

McMenamins, the Pacific Northwest hospitality company, reported a ransomware attack in December 2021. Intruders had access from about December 7. Stolen employee records included names, dates of birth and Social Security numbers. It notified 14,861 Oregon employees.

View all 13,177 breaches

Breach date: 7 Dec 2021
Made public: 30 Dec 2021
Data exposed: Names, Dates of birth, Social security numbers
Last updated: 28 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

McMenamins, a Pacific Northwest chain of pubs, hotels and theaters, said attackers got into its systems around December 7, 2021, and launched ransomware on December 12, when the company spotted suspicious activity. It notified the FBI and brought in cybersecurity experts.

The company told Oregon's Department of Justice it had notified 14,861 current and former employees in Oregon and said the total could exceed 30,000 records. The Washington Attorney General's notification list also carries the incident. The number of people nationwide hasn't been confirmed by the company in the sources used here.

Sources checked: infosecurity-magazine.com, darkreading.com, wweek.com

Last verified against the official page: 28 Oct 2026

How we research this Report an error

What was exposed

This was an employee breach, not a customer one. Reported coverage describes human resources and payroll files with names, contact details, dates of birth, Social Security numbers and income and retirement contribution figures. The company said direct deposit bank details might have been accessed but it had no clear evidence they were. Customer payment data was reportedly not affected.

What it means for you

If you worked there, a Social Security number and date of birth are enough to apply for credit or file a tax return in your name, sometimes years later. Payroll details also help scammers write convincing fake messages from an "employer" or "benefits provider".

The company's response

McMenamins mailed letters to people employed from July 1, 2010 to December 12, 2021, and pointed earlier employees (1998 to mid-2010) to its website because it lacked their contact details. It offered identity and credit protection services and set up a call center.

What to do if you were in it

1

Freeze your credit at all three bureaus

A Social Security number is in the exposed data, so a freeze is the strongest step. Per the FTC, a freeze is free, lasts until you lift it, and you place it separately at Equifax, Experian and TransUnion. You can also place a free fraud alert, which tells lenders to verify your identity first.
2

Watch your statements and credit reports

Check bank, card and insurer statements for charges or claims you don't recognize. The FTC's breach guidance walks through reporting identity theft if it happens.
3

Expect messages that mention the breach

Mail, calls and texts that quote real details, such as your provider's name, are a common follow-up to a breach. Don't click links or give out information on an unsolicited call. Contact the organization using a number from its official site.
4

Check whether your email or phone is in this and other breaches

Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details appear. It can't remove data that has already leaked, so the steps above still matter.