# Panera Bread Data Breach - 5.1 Million Accounts Exposed

> Panera Bread, a major US restaurant chain with 2,100+ locations and $5.9B annual revenue, suffered a ransomware attack that encrypted critical systems and exfiltrated data affecting approximately 5.1 million customers and employees. The attack disrupted operations for multiple days, affecting point-of-sale (POS) systems, online ordering, mobile app, loyalty program (MyPanera with 52M+ members), internal communications, and supply chain management. The breach exposed: names, email addresses, Social Security numbers (employees), dates of birth, physical addresses, loyalty program data, partial payment card information, and employment records. The incident highlights the devastating impact of ransomware on restaurant/retail chains where operational technology (POS, kitchen display systems, inventory management) and customer data systems are deeply interconnected.

- **Published:** 2026-02-02T23:55:00Z
- **Last reviewed:** 2026-02-02T23:55:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0031
- **ID:** TL-2026-0031
- **Severity:** MEDIUM (CVSS 6.5)
- **Category:** DATA_BREACH
- **Status:** MONITORING
- **Actor:** ShinyHunters (Russia)
- **Detections:** 12 · **IOCs:** 40 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The Panera Bread ransomware attack represents a critical case study in restaurant/retail sector cybersecurity, where operational technology disruption directly translates to revenue loss and customer data exposure at massive scale.

**The Target:**

Panera Bread Company operates 2,100+ bakery-café locations across the US and Canada with:
- $5.9B annual revenue (2023)
- 52M+ MyPanera loyalty members (one of the largest restaurant loyalty programs)
- 120,000+ employees across corporate, distribution, and restaurant locations
- Extensive digital infrastructure: online ordering, mobile app, delivery integration, kiosk ordering
- Complex supply chain: fresh-baked goods require daily distribution coordination

**The Attack:**

The ransomware attack encrypted critical systems across Panera's infrastructure:

1. **Point-of-Sale (POS) Systems**: In-store ordering and payment processing disrupted. Locations forced to operate cash-only or close entirely during the outage.

2. **Online Ordering & Mobile App**: Digital ordering channels (representing ~50% of revenue for fast-casual chains) went offline. The Panera mobile app and website were inaccessible for ordering.

3. **MyPanera Loyalty Program**: 52M+ member accounts inaccessible. Loyalty points, rewards, and subscription data affected. The Unlimited Sip Club (subscription coffee/tea program) could not process subscriptions.

4. **Internal Systems**: Corporate email, internal communications, employee scheduling, and HR systems encrypted.

5. **Supply Chain Management**: Fresh bread and ingredient distribution coordination disrupted. With Panera's emphasis on fresh-baked goods, supply chain disruption has outsized operational impact.

**Data Exfiltration:**

Before encryption, the attackers exfiltrated data affecting approximately 5.1 million individuals:

- **Customers**: Names, email addresses, dates of birth, physical addresses, loyalty program data, partial payment card information (last 4 digits, expiration), order history
- **Employees**: All customer data plus Social Security numbers, dates of birth, bank account information (direct deposit), tax withholding information, employment records, benefits enrollment
- **Corporate**: Internal documents, financial data, vendor agreements, strategic plans

**Impact Assessment:**

- **Revenue Loss**: Multiple days of disrupted or suspended digital ordering (~50% of fast-casual revenue). Individual locations reported 30-70% revenue drops during outage.
- **Operational Disruption**: POS failures forced cash-only operation or temporary closures. Kitchen display systems offline disrupted order fulfillment.
- **Brand Damage**: Major restaurant chain publicly unable to serve customers erodes brand trust. Competitors (Chipotle, Starbucks) captured diverted customers.
- **Regulatory Exposure**: 5.1M affected individuals triggers notification requirements across all 50 US states. Employee SSN exposure triggers enhanced regulatory scrutiny.
- **Legal Liability**: Multiple class-action lawsuits filed within weeks of breach disclosure. Employee data exposure (SSN, bank accounts) creates particularly strong legal claims.
- **Loyalty Program Trust**: 52M MyPanera members questioning data safety. Subscription program (Unlimited Sip Club) disruption affects recurring revenue.

**Root Cause Analysis:**

Restaurant chains face unique cybersecurity challenges:
- **Flat Network Architecture**: POS systems, back-office, corporate, and customer-facing systems often share network segments without adequate segmentation
- **Franchise/Corporate Split**: Mixed ownership models create inconsistent security practices across locations
- **High Employee Turnover**: Restaurant industry turnover rates (~75% annually) create credential management challenges
- **Legacy POS Systems**: Many locations run aging POS hardware/software with limited security capabilities
- **Digital Transformation Speed**: Rapid adoption of online ordering, delivery integration, and loyalty programs expanded attack surface faster than security could keep pace

**Industry Context:**

The Panera breach follows a pattern of major restaurant/retail ransomware incidents:
- **Yum! Brands (2023)**: KFC/Taco Bell/Pizza Hut parent hit by ransomware, 300 UK locations closed
- **Dine Brands (2023)**: IHOP/Applebee's parent experienced data breach
- **MOVEit (2023)**: Multiple restaurant chains affected via supply chain compromise
- **Colonial Pipeline effect**: Critical infrastructure ransomware demonstrates operational technology vulnerability

The restaurant sector is increasingly targeted because: (1) high revenue makes ransom payment likely, (2) operational disruption creates urgency to pay, (3) massive customer databases provide data monetization value, and (4) security maturity lags behind digital transformation pace.

## MITRE ATT&CK

- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1078 Valid Accounts
- T1591 Gather Victim Org Information
- T1596 Search Open Technical Databases
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1136 Create Account
- T1685 Disable or Modify Tools
- T1003 OS Credential Dumping
- T1046 Network Service Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery

## Sources

- [Panera Bread — Official](https://www.panerabread.com/)
- [CISA StopRansomware](https://www.cisa.gov/stopransomware)
- [FBI IC3 2023 Internet Crime Report](https://www.ic3.gov/)
- [NIST SP 800-171 Rev 3](https://csrc.nist.gov/pubs/sp/800/171/r3/final)
- [PCI DSS v4.0](https://www.pcisecuritystandards.org/)
- [NIST Cybersecurity Framework 2.0](https://www.nist.gov/cyberframework)
- [Verizon 2024 DBIR](https://www.verizon.com/business/resources/reports/dbir/)
- [MITRE ATT&CK — Ransomware](https://attack.mitre.org/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0031