Panera Bread Data Breach

In late January 2026, a dataset containing 5.1 million Panera Bread customer records was discovered on underground forums. The exposed data included customer names, email addresses, phone numbers, physical addresses, and MyPanera loyalty program details. Panera confirmed the incident and stated that payment card information was not affected. The data appeared to originate from a credential stuffing attack or a compromise of Panera's customer database.

Panera Bread operates over 2,000 bakery-cafe locations across the United States and Canada. Its MyPanera loyalty program has millions of members, making it a valuable target for credential theft and reward abuse.

The attack is believed to have involved credential stuffing (using reused passwords from other breaches) or a direct compromise of Panera's customer database. The absence of payment data suggests the attackers targeted loyalty and account information specifically.

Unknown threat actors likely focused on credential stuffing for financial gain through loyalty reward abuse.

Attribution sources

• Have I Been Pwned
• Panera Bread statements

Countries affected

• United States
• Canada

Data types

• PII
• Names
• Email addresses
• Phone numbers
• Physical addresses
• Loyalty program data

Reputational damage and potential regulatory fines.

Public reaction

Concern among loyalty program members about reward point theft and account security.

Significance

Highlights continued vulnerability of loyalty program databases to credential stuffing and account takeover attacks in the food service industry.

Publishing organisations

• Have I Been Pwned
• BleepingComputer

Panera confirmed the breach and took steps to secure affected accounts.

Official documents

• Panera Bread data breach notification

References

1. [1]Have I Been Pwned - Panera Bread breach listing
2. [2]BleepingComputer coverage