Panera Data Breach Lawsuit Says Current, Former Employees’ Info Stolen in March 2024 Cyberattack

New to ClassAction.org? Read our Newswire Disclaimer

Panera faces a proposed class action lawsuit in the wake of a significant March 2024 data breach during which the sensitive personal information of current and former employees was reportedly stolen by cybercriminals.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.

The 35-page Panera data breach lawsuit says the fast-casual restaurant chain stored employees’ data in its systems in a manner vulnerable to cyberattacks. According to the case, Panera had no effective means to prevent the data breach, and it is unknown for exactly how long the perpetrators had access to the restaurant chain’s network before the intrusion was discovered.

“In short, Defendant’s failures placed the Class’s [personally identifiable information] in a vulnerable position—rendering them easy targets for cybercriminals,” the filing alleges, adding that Panera data breach victims’ private information is now “forever exposed and unsecure.”

Related Reading: Panera Bread Company Delivery Fees Settlement

Panera runs more than 2,100 cafes throughout the United States and, as part of its regular business, maintains the personal data of thousands of current and former employees, the suit begins. In collecting this data, Panera agreed to safeguard the information in accordance with state and federal law and its own internal privacy policies, the case stresses.

The data breach class action lawsuit says that current and former Panera employees’ names, Social Security numbers and certain “[o]ther information you provided in connection with your employment,” at minimum, was compromised in the incident. 

The lawsuit alleges the data breach exposed a “far broader range” of personal information than Panera has admitted thus far.

To date, Panera has not disclosed when the data breach actually began, though it is believed the attack began sometime prior to March 23, 2024, the filing relays.

Though the Panera data breach is believed to have occurred sometime in or before March 2024, the restaurant waited until June 17 to begin sending a data breach notice to victims, a full 86 days after the incident was discovered, the case says. In its notice, Panera itself acknowledged the risk posed to current and former employees for identity theft and fraud, the complaint adds.

“Thus, Defendant kept the Class in the dark—thereby depriving the Class of the opportunity to try and mitigate their injuries in a timely manner.”

In the wake of the data breach, Panera has claimed to have taken steps to bolster its existing cybersecurity measures, though the lawsuit contends that this “vague language” fails to demonstrate the defendant has improved its data security.

Ultimately, Panera has been unable to determine the full scope of the data breach, including precisely what information was stolen, and done little to remedy the cyberattack, other than offer an insufficient amount of credit- and identity-monitoring services, the lawsuit charges.

The proposed class action notes that the March 2024 Panera data breach is only the latest cybersecurity incident to befall the restaurant, as in 2018 Panera reportedly exposed customers’ names, dates of birth, addresses, credit card details and more, comprising some 37 million customer records.

The Panera data breach lawsuit looks to cover all United States residents whose personal information was compromised in the data breach discovered by Panera in March 2024, including everyone who received notice about the incident.

Are you owed unclaimed settlement money? Check out our class action rebates page full of open class action settlements.