PaneraBread.com exposed millions of customer records in plain text for at least eight months before the site was taken offline on April 2, 2018. Reported fields included names, email addresses, physical addresses, birthdays and the last four digits of credit-card numbers. The number of affected records remains disputed: Panera said 10,000, while HoldSecurity estimated 37 million.
The incident involved records associated with online-ordering accounts. The cited reports do not establish that full card numbers, passwords or Social Security numbers were exposed, and no public evidence confirms that every affected record belonged to a unique person or was misused.
As an Amazon Associate I earn from qualifying purchases.
What happened at PaneraBread.com?
Security researcher Dylan Houlihan reportedly contacted Panera in August 2017 after finding customer information accessible through the website. According to Malwarebytes Labs, the records remained available for at least eight months. KrebsOnSecurity reported the exposure on April 2, 2018, after which Panera took the website offline. The site later returned with the exposed data no longer available.
Free tools Windows power users keep installed
One-click scans. No signup required.
The exposure mechanism was a publicly retrievable web database, not a reported campaign of stolen passwords. Anyone who could reach the exposed endpoint may have been able to read records without first breaking into individual customer accounts.
#1 Best Overall
Incident timeline
- August 2, 2017: The Identity Theft Resource Center lists this as the breach date for its 2018 Panerabread.com entry.
- August 2017: Researcher Dylan Houlihan reportedly alerted Panera.
- April 2, 2018: KrebsOnSecurity published its report and Panera pulled the site offline.
- April 3, 2018: Malwarebytes Labs published additional reporting and consumer guidance.
How many people were affected?
No single figure was independently confirmed. The published numbers describe different things: a company statement, an outside estimate and a later breach-database entry.
| Source and date | Number | How to interpret it |
|---|---|---|
| Panera statement, reported by Malwarebytes in 2018 | 10,000 records | Panera’s own reported count; the available reporting does not explain whether this means unique people or database rows. |
| HoldSecurity estimate, reported by Malwarebytes in 2018 | 37 million records | An outside estimate, not a confirmed count of unique customers. |
| Identity Theft Resource Center database, 2020 entry | 37,000,000 victims | A database figure tied to the Panerabread.com entry; it is not proof that 37 million unique individuals experienced identity-theft misuse. |
The ITRC also has a separate Panera entry dated 2026. That later entry should not be combined with the 2018 PaneraBread.com incident.
What information was exposed?
| Data type | Status in the cited 2018 reports |
|---|---|
| Names | Reported as exposed |
| Email addresses | Reported as exposed |
| Physical addresses | Reported as exposed |
| Birthdays | Reported as exposed |
| Last four digits of credit-card numbers | Reported as exposed |
| Full credit-card numbers | Not established by the cited reports |
| Passwords | Not established by the cited reports |
| Social Security numbers | Not established by the cited reports |
Do not treat Panera’s current list of collected data as a reconstruction of the 2018 leak. The contemporaneous reports support only the fields shown above.
Could your Panera account have been included?
The records appeared to cover customers who created PaneraBread.com accounts to order food online. Public reporting did not provide a consumer-facing lookup that can confirm an individual account, and the disputed totals make it impossible to infer exposure from the number alone.
Rank #3
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
If you used an online Panera account during the period before April 2018, treat the account as potentially included and review old Panera emails, saved payment methods and transaction history for anything unfamiliar. A lack of suspicious activity does not prove that a record was absent from the exposed data.
What affected customers should do
- Contact Panera if you suspect account compromise. Panera’s current U.S. privacy policy tells people who believe a MyPanera account has been compromised to contact the company.
- Remove stored payment information. The same policy advises immediately removing debit-card, credit-card, gift-card or other payment information associated with the account.
- Monitor credit reports and account activity. Malwarebytes recommended watching credit reports and financial accounts for unfamiliar applications, charges or changes.
- Turn on account alerts. Use alerts from banks, card issuers and other financial services so unusual activity generates a prompt notification.
- Be skeptical of follow-up scams. Names, email addresses, birthdays and physical addresses can make phishing emails, phone calls and text messages look convincing. Do not provide passwords, one-time codes or payment details to an unsolicited caller or message.
- Change reused credentials as a precaution. The cited reports do not establish password exposure, but any password reused on other services should be replaced with a unique password and protected by multifactor authentication where available.
Why the incident was serious
The risk came from the combination of direct identifiers and personal details being readable through a public website. Email and physical addresses support targeted phishing; birthdays and other profile information can help an impersonator sound credible. The last four card digits add context to scams even though the reports do not say that full card numbers were exposed.
The long interval between the reported August 2017 researcher notification and the April 2018 shutdown also meant the data could remain accessible while customers and the public were unaware. That duration is part of the incident’s significance, independent of which record count is correct.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What Panera’s current privacy policy adds—and what it does not prove
Panera’s current U.S. policy covers PaneraBread.com, its mobile app, in-cafe systems and MyPanera. It describes collection of account and transaction information, device and browser information, geolocation, inferences and other network activity. It also says information may be disclosed to service providers, analytics and advertising partners, data brokers and government authorities in specified circumstances.
Those current practices are context, not evidence that the 2018 exposed database contained every category now listed. The policy states that Panera maintains reasonable physical, electronic and procedural safeguards but cannot guarantee the security of information transmitted over the internet.
The practical takeaway
For the 2018 PaneraBread.com incident, the safest interpretation is that online-ordering customer records may have been publicly readable for months, with names, contact details, birthdays and partial card information exposed. Because the affected count was never settled publicly, customers who used the site should follow the same steps regardless of whether they accept Panera’s 10,000-record figure or the 37-million-record estimates: remove stored payment data, monitor accounts and credit reports, enable alerts and treat unexpected Panera-related messages as potential scams.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
