January 2026 Panera, LLC. Data Breach and 2026 Panera‑Related Extortion Attempts

In February 2026 multiple news agencies and cybersecurity companies reported that Panera, LLC (“Panera”) experienced a data breach affecting 5.1 million user accounts (the “Data Breach”). The notorious cybercriminals ShinyHunters have taken credit for the Data Breach and have leaked an archive of nearly 760 megabytes of data stolen in the Data Breach. It is currently unclear the extent of the Personally Identifiable Information (“PII”) stolen in the Data Breach but it, at minimum, includes people’s names, addresses, e-mail addresses, and telephone numbers.

Beginning in late‑January 2026, individuals impacted by the Panera breach have begun receiving extortion emails and text messages referencing Panera. These messages typically threaten to expose or misuse personal information unless payment is made. Our office has received multiple reports of nearly identical extortion messages, indicating a coordinated effort by cybercriminals using data associated with the Panera breach.

At this stage of our investigation, we are specifically looking to speak with individuals who:

• Received extortion emails or texts explicitly mentioning Panera and
• Received these messages on or after late‑January 2026.

We may also be interested in individuals who have experienced clear and recent (2026) identity fraud, even if no extortion message was received.

Your Personally Identifiable Information (PII) includes details that can uniquely identify you. When compromised, this information can be used by cybercriminals to commit identity theft, fraud, or other misuse.

Protected Health Information (PHI) involves medical‑related data and is strictly regulated under federal and state law. PHI can be combined with other PII to commit medical identity theft, a type of fraud that can be extremely difficult to detect and resolve.

If your data is exposed, criminals may use it to open fraudulent accounts, file false tax returns, access medical services under your name, or commit other forms of fraud. Prompt enrollment in identity monitoring services is strongly recommended.

Residents of California also have enhanced privacy rights under the California Consumer Privacy Act (CCPA) and additional protections under the Confidentiality of Medical Information Act (CMIA).

If you received a NOTICE OF DATA BREACH letter from Panera, or if you have received an extortion email or text referencing Panera since late‑January 2026, your personal information may be at risk and could be misused for identity theft or fraud.