Panera Bread data breach (January 2026): what Panera confirmed
In January 2026 Panera Bread confirmed a breach of customer contact information during the ShinyHunters SSO wave.
Short answer
Was Panera Bread hacked?
Yes. Panera confirmed a breach to Reuters and said “the data involved is contact information.” Have I Been Pwned counted about 5.1 million unique accounts.
ShinyHunters claimed 14 million records and said it got in by compromising Microsoft Entra single sign-on through voice phishing. Panera has not confirmed the method.
Timeline at a glance
Jan 2026Panera confirms customer contact information was taken. (Security Affairs)Confirmed
Last updated October 31, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Panera Bread’s security posture at the time
What Panera Bread publicly said about its security certifications and controls, how big it is, and how its shares moved, each tied to a source. A certificate covers a stated scope at a point in time; it is not a guarantee about every system. Reviewed 31 October 2026. Compare all 2026 breaches.
Security certifications publicly held
No public certification found.
No public certification found on the company’s own security, trust or compliance pages, in filings, or in the certificate registries searched (BSI, CSA STAR). That is a data point, not proof that none exists.
Publicly known security controls and platforms
Microsoft Entra single sign-on: ShinyHunters says it got in by compromising Entra SSO through voice phishing. Panera has not confirmed the method. (attacker claim; Security Affairs — Panera Bread)
Size
Private, not disclosed
Listing: Private
Share price around the disclosure
Not listed.
Panera Bread incident timeline, in detail
Confirmed = acknowledged by Panera Bread, a regulator filing or a court. Reported = credible reporting Panera Bread has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Jan 2026ConfirmedIdentity / SSO
Customer contact data taken during the ShinyHunters SSO wave
What happened. Panera confirmed a breach to Reuters and said “the data involved is contact information.” ShinyHunters claimed 14 million records and leaked an archive after Panera did not pay; Have I Been Pwned counted about 5.1 million unique accounts.
Impact. Names, emails, phone numbers and addresses, per published analysis. People or records affected: About 5.1 million unique accounts, per Have I Been Pwned (reported by Security Affairs).
We found no SOC 2 or ISO 27001 certification published by Panera Bread. That does not prove it had none; it means none was public.
The way in was a person, not a server
Like most of 2026’s large data thefts, this one is described as starting with social engineering: a phished or voice-phished login, often to single sign-on, then bulk export from a SaaS application. Certification audits test that identity controls exist and operate; they do not promise that no employee or contractor will ever be talked out of a login.
What it means for Panera Bread Panera customers and employees — and what to do
What Panera Bread’s customers, partners and security teams can do now, based only on what has been disclosed.
1.Assume phishing follows the breach
Exposed contact details are used for convincing follow-up phishing. Warn staff and customers that genuine notices will not ask for passwords or payment.
2.Check your own help-desk and SSO flows
Require callback verification and phishing-resistant MFA for account and MFA resets; voice requests alone should never reset a login.
3.Ask the vendor what was exported, in writing
Ask which applications and fields were reached, the date range, and whether your organisation’s records were included.
Yes. Panera confirmed a breach to Reuters and said “the data involved is contact information.” Have I Been Pwned counted about 5.1 million unique accounts.
Did Panera Bread have SOC 2 or ISO 27001 certification?+
We found no SOC 2 or ISO 27001 certification published by Panera Bread. That does not prove it had none; it means none was public.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Panera Bread. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout