2026 ShinyHunters breach — 5.1M–14M customer records
Data compromised
Names, emails, phone numbers, addresses, partial payment data, rewards info, order history
Technical writeup
ShinyHunters breached Panera Bread in January 2026 via Microsoft Entra SSO credentials obtained through voice phishing. Attackers impersonated IT support to trick employees. After failed extortion, ~760MB of compressed data was dumped with 5.1M unique emails. Class action lawsuits filed by mid-February 2026.
Root cause
Voice phishing; stolen SSO credentials