2026 7-Eleven — 185,000+ individuals; franchise systems + ShinyHunters extortion (Apr–May)
Data compromised
Names, DOB, addresses, SSNs per state notices; parallel ShinyHunters Salesforce marketing
Technical writeup
7-Eleven, Inc. began notifying individuals in May 2026 after detecting unauthorized access on April 8, 2026 to systems storing franchisee-related documents and personal information from franchise applications. State regulatory listings and TechCrunch/BleepingComputer reporting cited more than 185,000 people affected with data including names, dates of birth, postal addresses, and Social Security numbers in government breach databases—far above early single-state sample filings. Separately, ShinyHunters listed 7-Eleven in April 2026 claiming 600,000+ Salesforce records and marketing resale of the archive. BreachHistory aligns the headline victim count with published regulatory totals while noting parallel criminal-forum claims may overlap other data classes.
Root cause
Unauthorized access to franchisee document systems; parallel ShinyHunters Salesforce data-theft campaign (phishing / integration abuse per industry reporting)
References
- https://www.bleepingcomputer.com/news/security/7-eleven-data-breach-exposes-personal-information-of-185-000-people/
- https://techcrunch.com/2026/05/26/7-eleven-data-breach-affects-over-185000-peoples-personal-data/
- https://www.securityweek.com/7-eleven-data-breach-confirmed-after-shinyhunters-ransom-demand/