ON 2 February 2026, Panera Bread’s data breach was linked to 5.1 million accounts, according to Have I Been Pwned. Have I Been Pwned followed claims by the ShinyHunters gang that data from more than 14 million Panera Bread accounts had been stolen, after which a 760MB archive was leaked on the group's data leak site. ShinyHunters said they gained access to Panera’s systems using a Microsoft Entra SSO code as part of a broader vishing campaign targeting SSO accounts at more than 100 organisations.
BleepingComputer later confirmed that roughly 5,120,000 accounts were impacted, noting that the total could be lower if individuals held multiple accounts. Panera Bread confirmed to authorities that the exposed data consisted of contact information and said authorities were notified.