Panera Bread data breach exposes 5.1M customers

Another major consumer brand has joined the growing list of companies hit by serious data breaches. Panera Bread has confirmed a cybersecurity incident after the hacking group ShinyHunters claimed it stole millions of customer records.

The breach exposes a wide range of personal details, raising real concerns for anyone who has ever placed an order, created an account or shared contact information with the popular bakery chain.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you'll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

SUBSTACK DATA BREACH EXPOSES EMAILS AND PHONE NUMBERS

ShinyHunters added Panera Bread to its data leak site earlier this year, initially claiming it had stolen more than 14 million customer records. According to the group, the stolen data includes names, email addresses, phone numbers, home addresses and account-related information.

Panera Bread has since confirmed a cybersecurity incident. In a statement to media outlets, the company described the exposed data as customer "contact information" and said it has contacted law enforcement and taken steps to address the incident. Panera has not shared technical details about how the attack occurred or whether customers need to take specific actions.

Even "contact information" can be dangerous in the wrong hands. When combined, these details can be used for identity theft, targeted phishing and highly convincing social-engineering scams.

ShinyHunters claims the attackers accessed Panera's systems through Microsoft Entra single sign-on (SSO). While Panera has not confirmed that claim, it closely mirrors recent warnings from Okta about a surge in voice-phishing attacks targeting SSO platforms.

In these attacks, criminals pose as IT or helpdesk staff and call employees directly. They pressure targets to approve authentication requests or enter login credentials on fake SSO pages. Once attackers capture session tokens or credentials, they can bypass some forms of multifactor authentication and move laterally through company systems. This approach relies on human trust rather than technical exploits, making it increasingly effective.

At first glance, claims that 14 million customers were affected suggested an enormous breach. However, researchers at Have I Been Pwned? later clarified that the attackers stole 14 million records, not data tied to 14 million unique individuals.

After reviewing the leaked dataset, researchers now estimate the breach affected approximately 5.1 million unique people. The exposed information includes email addresses along with associated names, phone numbers, and physical addresses.

That distinction matters, but it does not eliminate risk. Once stolen data is released publicly, it can spread quickly across criminal forums and be reused for years.

149 MILLION PASSWORDS EXPOSED IN MASSIVE CREDENTIAL LEAK

ShinyHunters reportedly attempted to extort Panera Bread before publishing the stolen data. When those efforts failed, the group released a 760MB archive containing millions of customer records on its leak site.

This reflects a broader shift in cybercrime. Instead of locking systems with ransomware, many groups now focus on quietly stealing data and threatening public exposure. These attacks are faster, harder to detect, and often just as profitable.

ShinyHunters has used similar tactics in other high-profile incidents involving Bumble, Match Group, Crunchbase and other consumer platforms.

The breach has already triggered legal fallout. Multiple class-action lawsuits have been filed in U.S. federal court, alleging that Panera failed to adequately protect customer data.

The lawsuits claim Panera knew or should have known about security weaknesses and seek damages, improved security practices, and long-term identity theft protection for affected customers. Panera has not publicly commented on the litigation.

This is not Panera Bread's first major security lapse. In 2018, a cybersecurity researcher revealed that Panera had left millions of customer records exposed online in plain text. That incident later led to lawsuits and settlements.

Repeated breaches often point to deeper challenges. Large organizations can struggle to secure cloud services, identity systems, and employee access at scale. When attackers target identity platforms instead of infrastructure, a single mistake can expose millions of records.

We reached out to Panera Bread for a comment, but did not hear back before our deadline. 

GRUBHUB CONFIRMS DATA BREACH AMID EXTORTION CLAIMS

When a major consumer brand suffers a breach, customers often don't realize the risk until weeks or months later. These steps help limit what attackers can do with your information if your Panera data falls into the wrong hands.

If you ever created a Panera Bread account, reset its password immediately. If you reused that password anywhere else, those accounts are now at risk, too. Attackers routinely test breached passwords across email, shopping and banking sites.

A password manager helps by generating strong, unique passwords for every account and storing them securely so you never need to reuse credentials. Many password managers also alert you if your email or passwords appear in known data breaches, giving you an early warning to lock things down fast.

Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

Two-factor authentication (2FA) adds a second step to the login process, usually through an app or device you control. Even if someone gets your password through phishing or a breach, 2FA makes it much harder for them to access your account.

Cybercriminals often follow up breaches with fake emails or in-app messages pretending to offer help or security updates. Always double-check the sender and avoid clicking links. When in doubt, open the app or website directly rather than responding to the message. Using strong antivirus software adds another layer of protection by flagging malicious links and blocking known threats before they can do harm. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.

When names, email addresses, phone numbers and physical addresses are exposed, identity theft becomes a real risk. Identity theft-protection services monitor your personal information, alert you if it appears on the dark web, and watch for attempts to open new accounts in your name.

If something does go wrong, these services often include recovery support to help freeze accounts, dispute fraud, and guide you through the cleanup process.

See my tips and best picks on how to protect yourself from identity theft at Cyberguy.com.

Scammers don't rely on one breach alone. They combine leaked data with information from data broker sites to build detailed profiles. Data removal services help remove your phone number, home address and other personal details from hundreds of these sites.

While no service can erase everything, reducing what's publicly available makes it much harder for criminals to target you with convincing scams or identity fraud. This is one of the most effective long-term ways to lower your risk after any major breach.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

Your email account controls password resets for most services. Protect it with a strong password and 2FA. Regularly review login activity and recovery settings, so attackers can't use your email to take over other accounts.

Not every breach leads to immediate account takeovers. In some cases, attackers quietly test access weeks later. That is why staying alert after breach reports matters. Watch for password reset emails you did not request, profile changes you did not make, or new messages you did not send. Unexpected logouts or security alerts are also red flags. If you notice anything unusual, change your password immediately and review your security settings.

The Panera Bread data breach is another reminder that even familiar brands can become major cyber targets. While Panera says only contact information was exposed, that data is often enough to fuel scams and identity theft long after headlines fade. Staying proactive after breach news is now part of protecting your digital life.

Do you still trust large brands to protect your personal information, or have repeated breaches changed how much data you're willing to share? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Copyright 2026 CyberGuy.com. All rights reserved.