Panera Bread data breach: what happened and what to do

What happened

Have I Been Pwned (HIBP) dates the Panera Bread breach to 7 January 2026 and added it to its database on 31 January 2026. It lists 5,112,502 accounts, counted as unique email addresses. The extortion group ShinyHunters claimed the theft and, according to news coverage, published the stolen data after Panera did not meet its demand. The group had claimed a larger record count (14 million) than HIBP's count of unique email addresses.

Panera told reporters that the data involved is contact information and that it had notified authorities. Press coverage reports that the attackers said they got in through single sign-on accounts, part of a wider campaign of phone-based phishing against many companies. That detail comes from the attackers' own account, and Panera has not described its cause.

This is not the 2024 Panera incident, which involved a different data set. Pages and tools that mix the two up often quote the wrong numbers.

What was exposed

HIBP lists four data types: email addresses, names, phone numbers and physical addresses. No passwords, payment cards or dates of birth are listed. That makes this a contact-details breach: the kind of record a marketing or loyalty system holds.

What criminals can do with contact details

Contact data sounds harmless, and the exposure is smaller than with a password dump. It still has real uses for a scammer. A name plus an address plus a phone number is enough to build a believable message: "Your Panera order was refunded, confirm your details", or a text claiming a gift card or reward is about to expire. Because the criminal knows you are a Panera customer, the message arrives with a believable reason attached.

Address and phone number together also feed people-search listings and spam databases. Data from a breach tends to spread from the original leak into other lists, and once it is there it can show up for years. You can't pull a leaked list back, but you can cut the follow-on harm by treating unexpected messages with suspicion.

Phone numbers deserve special attention. Text-message scams (smishing) have a higher success rate than email scams for many people, because texts feel more personal and links get opened on a phone, where it is harder to check the address.

Panera's response

Panera said the data involved is contact information and that authorities were notified. Press reports early in February noted that Panera had not publicly started notifying affected customers at that point. If you hear from Panera, treat the message with care: check that it came from an address on Panera's own domain, and don't click links inside it.

Are you in the breach?

If you ever signed up for a Panera account, a rewards membership or an online order with an email address, you could be among the 5.1 million. Check every email address you have used, not only the current one. HIBP shows which breaches an address appears in, and about what was exposed.

The steps below are mostly about avoiding scams. A credit freeze isn't a priority here since no identity documents or dates of birth are listed.