Apple American Group Data Breach

Apple American Group says hackers broke into its computer servers in April 2026. Current and former employees did not learn about it until mid-August, more than four months later.

Apple American Group LLC and Apple American Group II, LLC, one of the largest Applebee’s and IHOP franchise operators in the United States, has notified current and former employees of a data breach involving company servers. According to the notice, the company became aware of suspicious network activity on April 9, 2026, and its investigation determined that an unknown actor accessed certain servers between April 8 and April 9, 2026, and accessed or acquired certain files during that time.

Apple American Group began mailing notice letters to affected individuals on August 18, 2026, roughly four and a half months after the intrusion was first identified. The company also reported the incident to the California Attorney General on the same date.

A Four-Month Gap, and an Employee Data Set, Not a Customer One

Two things stand out about this breach. First, the timeline: Apple American Group identified the intrusion in April 2026 but did not notify affected individuals until August 2026, a gap of more than four months. Second, the notice letter itself states that the exposed information relates to data “provided to us during the course of your employment,” meaning this is an employee data breach rather than a customer or diner data breach. Current and former employees of Apple American Group’s restaurants, not customers who ate at an Applebee’s or IHOP location, are the people affected.

Apple American Group’s California Attorney General filing confirms 4,954 affected Rhode Island residents. Separate, secondary reporting not yet independently verified against Vermont’s own attorney general records places the Vermont figure at 2,992 residents. Apple American Group employs people in dozens of states, but the company has not disclosed a national total.

What Information Was Exposed?

The version of the notice letter posted to the California Attorney General’s website leaves the list of exposed data categories blank, a placeholder field that was not filled in before the sample was published. The letter confirms only that the exposed information is data employees provided to the company during their employment. Apple American Group has not made the specific data categories, such as Social Security numbers, dates of birth, or payroll information, publicly available at this time.

• Employment-related personal information (specific categories not itemized in the posted notice)

What Is Apple American Group Offering?

Apple American Group is offering twelve months of complimentary credit monitoring and identity theft protection services through CyberScout, a TransUnion company. Affected individuals who want to enroll must do so within 90 days of the date on their notice letter by visiting bfs.cyberscout.com/activate and entering the unique code included in their letter. Questions can be directed to the company’s dedicated assistance line, available Monday through Friday between 8:00 a.m. and 8:00 p.m. Eastern, or to the company’s legal department at 216-525-2775.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage employee data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

Do You Have Legal Options?

Employers have a legal duty to safeguard the personal information their employees provide to them. Current and former employees affected by this breach may have rights and remedies under California and other state law, including claims tied to the length of time it took Apple American Group to notify affected individuals.

If you are a current or former employee of Apple American Group and believe your information was affected, contact the Data Breach Attorneys at Emery | Reddy for a Free Case Review.

Frequently Asked Questions

How many people were affected by the Apple American Group breach?

Apple American Group has not disclosed a national total. State filings confirm 4,954 affected Rhode Island residents, and separate secondary reporting, not yet independently verified, places the Vermont figure at 2,992 residents. Apple American Group operates in dozens of states.

Is this a customer data breach or an employee data breach?

This is an employee data breach. The notice letter describes information that employees provided to the company during the course of their employment, not information collected from restaurant customers.

What happened, and when?

Apple American Group identified suspicious network activity on April 9, 2026. Its investigation determined an unknown actor accessed certain servers between April 8 and April 9, 2026, and accessed or acquired certain files. The company began notifying affected individuals on August 18, 2026.

Why did it take more than four months to notify affected employees?

Apple American Group has not publicly explained the reason for the gap between identifying the intrusion in April and sending notice letters in August.

What should I do if I received this notice, or if I am a current or former employee?

Consider enrolling in the free credit monitoring services Apple American Group is offering before the 90-day enrollment window closes. Watch your financial accounts and credit reports for unfamiliar activity. Keep a copy of your notice letter, and consider speaking with a data breach attorney about your options.

Do I have a legal claim?

You may. Employers are required by law to protect the personal information their employees provide to them, and a lengthy delay in notification can be relevant to that obligation. Contact the Data Breach Attorneys at Emery | Reddy at 206.207.8929 or emeryreddy.com for a Free Case Review. No Fee Unless We Recover.