Panera data breach: what happened and what to do

What happened

In January 2026, the bakery-cafe chain Panera Bread had customer data stolen and later published. Have I Been Pwned (HIBP), the breach-tracking service, says the attackers took 14 million records after an extortion attempt failed, and that the published data covers 5.1 million unique email addresses. The gap matters: one person can appear in several records, so 14 million is a count of rows, not of people.

Panera told reporters that the data involved is contact information and that it notified law enforcement. Panera has shared few technical details about how the attackers got in. Security Affairs reported HIBP's confirmation of the 5.1 million figure. Panera also filed a notice with the Washington Attorney General covering 1,564 Washington residents. That is one state's count, not the national total.

This is not the same incident as Panera's earlier breach in 2024. If you're searching your old email for a Panera letter, check the date on it.

What was exposed

HIBP lists four kinds of data: email addresses, names, phone numbers and physical addresses. Panera's own description matches that: contact details. No passwords, payment cards or Social Security numbers are listed by HIBP or in the company's statement to the press.

What that lets criminals do

Contact details are less dangerous than a Social Security number, but they aren't harmless. A name, an email address, a phone number and a home address together are enough to make a scam message look personal.

Expect phishing emails and text messages that mention Panera, a loyalty account, a refund or a gift card. The FTC advises not to click links or call numbers in an unexpected message, and to contact the company through a number or site you already trust instead.

The same details help with a phone scam too. A caller who knows your address and the chain you eat at sounds like they have a real reason to be calling. Your phone number can also be used by someone trying to talk a mobile carrier into moving your number to a new SIM, so it's worth knowing how to lock your carrier account.

What Panera has said and done

The company has confirmed that contact information was involved and that authorities were told. It hasn't published an account of how the attack happened, and it hasn't confirmed the attackers' own claims about how they got in.

Was your account involved?

HIBP lets you search an email address against its list. If yours is there, treat it as a prompt to be careful with messages about Panera for the next several months, and to review the accounts that use the same email address. Breach data tends to circulate long after the first headlines fade, so the scam messages can arrive months later.