ShinyHunters Dumps 5.1 Million Panera Bread Customer

Ransom Refused, Data Dumped

The notorious ShinyHunters hacking group has published a 760 MB archive containing 5.1 million Panera Bread customer records on the dark web after the company refused to meet their ransom demand. The data dump includes names, email addresses, phone numbers, physical addresses, and account information tied to Panera's loyalty program and online ordering systems.

What Was Leaked

The 760 MB archive was posted to a well-known dark web leak site frequented by ShinyHunters. Security researchers have confirmed the data appears authentic based on sampling and cross-referencing with publicly available information.

Breach Overview

ShinyHunters Track Record

ShinyHunters is one of the most prolific data theft groups operating today. Their confirmed breaches include:

• AT&T (2024) — 73 million customer records
• Ticketmaster / Live Nation (2024) — 560 million records
• Mashable (2024) — Full database dump
• Microsoft GitHub repositories (2020) — 500 GB of source code
• Tokopedia (2020) — 91 million user accounts

The group's modus operandi is consistent: breach, exfiltrate, demand ransom, and publish if payment is refused. They have shown no hesitation in following through on threats, making their ransom demands particularly credible to victim organizations.

Legal Response: Three Class Action Lawsuits Filed

Three separate class action lawsuits have been filed in the U.S. District Court for the Eastern District of Missouri against Panera Bread. The plaintiffs allege:

Key Claims

1. Negligence — Panera failed to implement adequate data security measures despite handling millions of customer records
2. Prior breach history — Panera suffered a similar data breach in March 2024, yet failed to remediate the underlying security weaknesses
3. Delayed notification — Affected customers were not promptly informed of the breach
4. Unjust enrichment — Panera profited from collecting customer data without investing in proper safeguards

What Plaintiffs Are Seeking

• Compensatory and statutory damages for all affected customers
• Lifetime identity theft protection and credit monitoring at Panera's expense
• Injunctive relief — Court-ordered security improvements
• Legal fees and costs for the class

The fact that Panera experienced a similar breach in March 2024 is central to the lawsuits. Plaintiffs argue this demonstrates a pattern of negligence and that the company had clear warning to strengthen its defenses but failed to act.

Recommendations for Affected Customers

1. Change your Panera account password immediately — And any other accounts where you reused the same credentials
2. Enable multi-factor authentication — On email, banking, and all critical accounts
3. Monitor bank and credit card statements — Watch for unauthorized charges
4. Be wary of phishing — Expect Panera-themed scam emails and texts in the coming weeks
5. Consider a credit freeze — Contact Equifax, Experian, and TransUnion to prevent fraudulent account openings
6. Check breach notification databases — Use Have I Been Pwned to see if your email appears

Sources

• SecurityWeek — ShinyHunters Leaks 5.1 Million Panera Bread Records
• The Register — Panera Bread Data Dumped After Ransom Refused
• Fox News — Three Lawsuits Filed After Panera Bread Data Breach

Related Reading

• Telus Digital Confirms Massive Breach After ShinyHunters
• Fintech Giant Figure Technology Confirms Breach: Nearly 1
• ShinyHunters Dumps Harvard and UPenn Data After Ransom