--- title: "Panera Bread contact-information data incident" description: "Evidence-backed account of Panera Bread contact-information data incident, covering what happened, impact, timeline, attack vector, technical details, and primary sources." incident_type: "Data incident" status: "active" last_modified: "2026-08-09" canonical_url: "https://www.ally.security/incidents/panera-bread-contact-information-data-incident-2026" markdown_url: "https://www.ally.security/incidents/panera-bread-contact-information-data-incident-2026.md" stix_url: "https://www.ally.security/incidents/panera-bread-contact-information-data-incident-2026/stix.json" --- # Panera Bread contact-information data incident A Panera Bread incident confirmed by the company and associated with a later-public contact-information corpus. A verified HIBP corpus of unique email addresses and associated contact information, with separate record and account measurements preserved from other sources. Last modified Aug 9, 2026 · 3 sources ## Summary - **Environment:** Not publicly identified - **Operational impact:** No outage or recovery duration quantified - **Financial impact:** No public cost estimate ## What happened A [Panera Bread](https://www.panerabread.com/) incident confirmed by the company and associated with a later-public contact-information corpus. [2](#source-2) [3](#source-3) ## Impact A verified HIBP corpus of unique email addresses and associated contact information, with separate record and account measurements preserved from other sources. [2](#source-2) [3](#source-3) Documented data types include: - Names — Names associated with records in the verified HIBP corpus. [2](#source-2) [3](#source-3) - Contact information — Email addresses, phone numbers, and physical addresses associated with records in the verified HIBP corpus. [2](#source-2) [3](#source-3) A cited record reports 5,120,000 records (BleepingComputer's direct count of unique user accounts in the released records; it may represent fewer people because one person may have used multiple accounts). [1](#source-1) A cited record reports 5,112,502 records (Unique email addresses represented in the verified HIBP corpus; not a Panera-confirmed count of people, customers, accounts, documents, or total database rows; as of 2026-01-31). [1](#source-1) [2](#source-2) [3](#source-3) BleepingComputer found more than 26,000 unique panerabread.com email addresses in the released records and assessed that they likely belonged to Panera Bread employees. [1](#source-1) [3](#source-3) After an attempted extortion, an archive associated with Panera Bread was published on the ShinyHunters leak site. [1](#source-1) [2](#source-2) [3](#source-3) Panera Bread characterized the data involved as contact information. [2](#source-2) [3](#source-3) ## Timeline ### January 7, 2026 — Documented event HIBP BreachDate; not established by Panera as an exact intrusion, detection, containment, exfiltration, or publication date. [2](#source-2) ### January 28, 2026 — Public disclosure Date Reuters published Panera's emailed confirmation; no separate first-party public-notice date was found. [3](#source-3) ### August 9, 2026 — Briefing updated This briefing was last reviewed and updated on August 9, 2026. ## Threat Group & Attack Vector The cited public record does not establish a specific initial-access vector, malware family, exploited vulnerability, or ATT\&CK technique. ### Actors - ShinyHunters ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response Panera Bread confirmed to Reuters by email that an incident occurred. Panera Bread said it alerted authorities about the incident. The evidence ledger retains 2 disputed claims with the original citations rather than silently resolving the conflict. No access path, attribution, scale, or recovery detail is inferred beyond the cited claims. [1](#source-1) [2](#source-2) [3](#source-3) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Panera Bread breach impacts 5.1 million accounts, not 14 million customers research · BleepingComputer · Feb 2, 2026 ### Panera Bread breach record advisory · Have I Been Pwned · Jan 31, 2026 ### Bumble, Match, Panera Bread and CrunchBase hit by cyberattacks, Bloomberg News reports news · Reuters (syndicated by MarketScreener) · Jan 28, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** January 2026 Panera Bread data breach: Panera Bread confirmed to Reuters by email that an incident occurred. 2. **Resulted In · 85% confidence · current** Panera Bread contact-information corpus: BleepingComputer found more than 26,000 unique panerabread.com email addresses in the released records and assessed that they likely belonged to Panera Bread employees. 3. **Affected Organization · 100% confidence · current** January 2026 Panera Bread data breach: Panera Bread 4. **Exposed Data Category · 100% confidence · current** Panera Bread contact-information corpus: Names 5. **Exposed Record Count · 95% confidence · current** Panera Bread contact-information corpus: 5,120,000 record 6. **Exposed Record Count · 100% confidence · current** Panera Bread contact-information corpus: 5,112,502 record 7. **Resulted In · 95% confidence · current** January 2026 Panera Bread data breach: Panera Bread contact-information corpus 8. **Attributed To · 70% confidence · disputed** January 2026 Panera Bread data breach: ShinyHunters 9. **Disclosed At · 100% confidence · current** January 2026 Panera Bread data breach: 2026-01-28 10. **Occurred At · 80% confidence · current** January 2026 Panera Bread data breach: 2026-01-07 11. **Resulted In · 100% confidence · current** January 2026 Panera Bread data breach: Panera Bread said it alerted authorities about the incident. 12. **Exposed Record Count · 65% confidence · disputed** Panera Bread contact-information corpus: 14,000,000 record 13. **Exposed Data Category · 100% confidence · current** Panera Bread contact-information corpus: Contact information 14. **Resulted In · 90% confidence · current** Panera Bread contact-information corpus: After an attempted extortion, an archive associated with Panera Bread was published on the ShinyHunters leak site. 15. **Resulted In · 100% confidence · current** Panera Bread contact-information corpus: Panera Bread characterized the data involved as contact information.