Regional Grocery & Restaurants · Restaurant · Structural / no discrete incident
Panera Bread
Headline
Panera shows a genuine double-jeopardy pattern of repeated breaches, and the first one carries a detail worth remembering: the original exposure was reported to Panera by an outside security researcher and, by that…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Panera shows a genuine double-jeopardy pattern of repeated breaches, and the first one carries a detail worth remembering: the original exposure was reported to Panera by an outside security researcher and, by that researcher's account, went substantially unaddressed for a long period before it became public. That is a disclosure-handling failure rather than a security failure, and it is the more damaging of the two, because a company that ignores a free warning has removed the last defence it had. Panera's loyalty programme also ties order history to identity across every location.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
A GENUINE 'DOUBLE JEOPARDY' PATTERN OF REPEATED BREACHES: (1) Panera was notified by an independent security researcher (Dylan Houlihan) as early as AUGUST 2017 about a vulnerability, but reportedly failed to fix it promptly. (2) A 2024 ransomware breach affected about 147,321 people, mostly current and former EMPLOYEES (names and Social Security numbers), resulting in a $2.5 MILLION settlement (final approval hearing Jan 29, 2026) — that settlement was STILL BEING FINALIZED when (3) a completely SEPARATE, NEW breach hit in January 2026: the ShinyHunters hacking group (the SAME group responsible for the Air France/KLM and Workday breaches documented elsewhere in this tracker) reportedly gained access through a voice-phishing ('vishing') social-engineering attack in which callers posed as IT support to obtain Microsoft Entra single-sign-on credentials, exposing customer names, email addresses, phone numbers, physical addresses and account details (some reports also cite birth dates) for approximately 5.1 MILLION unique email addresses per Have I Been Pwned (from an initially-claimed 14 million total records) — Panera stated that login credentials, payment card information and financial data were not part of the breach. When Panera allegedly REFUSED to pay a ransom demand, ShinyHunters published a 760-megabyte data archive on its leak site. Multiple putative class actions (at least three located) were filed within days in the U.S. District Court for the Eastern District of Missouri (Keleshian, filed Jan. 29, 2026; Cardin, No. 4:26-cv-00125, and Cipriani, No. 4:26-cv-00126, both filed Jan. 30, 2026), alleging negligence, unjust enrichment, and invasion of privacy — commentators (and reportedly some plaintiffs) point to Panera's PRIOR 2017 vulnerability-notification history as evidence of a longstanding pattern of inadequate security attention, not an isolated incident.
Fees and billing
The 2024 employee breach settlement ($2.5 million) is separate and already in the claims process; no court-approved claims site existed yet for the 2026 customer breach as of this research — customers should retain any dark-web notification they received in case a future settlement requires it as documentation.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy panerabread.com/en-us/privacy.html | Not fetched yet | NO (HTML only) |
| Terms of service panerabread.com/en-us/terms-of-use.html | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.