Panerabread.com Leaks Millions of Customer Records
Summary: Panerabread.com exposed millions of customer records in plain text, including names, email and physical addresses, birthdays, the last four digits of credit card numbers, and loyalty card numbers, for at least eight months before the site was taken offline on April 2, 2018. Security researcher Dylan Houlihan first reported the leak on August 2, 2017, and Panera's director of information security initially dismissed it as a likely scam before the company acknowledged the issue and said it was working on a fix.
What's compelling: Sequential account IDs let anyone increment through the database and scrape every record, and the final count of exposed records climbed from an initial 7 million to more than 37 million after Panera's own claim of 10,000 was contradicted.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026