7-Eleven, Inc. is a convenience-store chain and franchisor (7NOW delivery, 7Rewards loyalty app) headquartered in Irving, Texas, and is a wholly owned subsidiary of Seven-Eleven Japan Co., Ltd., itself part of Tokyo-listed Seven & i Holdings Co., Ltd. Its consumer privacy notice discloses a broad CCPA-style collection footprint (identifiers, commercial/transaction data, geolocation, internet-activity, protected-class characteristics, audio/visual, and inferences), the use of cookies, pixels/web beacons and in-store Bluetooth beacon technology (with app consent), and self-declares both a 'sale' of personal information and a 'sharing' of personal information for cross-context behavioral advertising, alongside sharing with Business Partners including social-media networks for interest-based ads. The notice states 7-Eleven implements 'reasonable security measures' but cannot guarantee transmission security. Have I Been Pwned's breach catalog lists a 2026 incident affecting approximately 185,256 accounts, with dates of birth, email addresses, names, phone numbers, and physical addresses exposed; no regulator order or independent audit was found in this research.
TRACK RECORD
1 BREACH
[2026-04-08] · BREACH
Have I Been Pwned lists a breach record for 7-Eleven: "7-Eleven".
Approximately 185,256 accounts affected, per HIBP.
7-Eleven's consumer privacy notice states that, in the last 12 months, the categories of Personal Information collected about California consumers include Personal Identifiers, Cal. Civil Code 1798.80(e) customer-record information, Commercial and transaction information, Internet or other electronic network activity information, Geolocation data, Characteristics of protected classifications, Audio and visual information (e.g. customer-service call recordings), and Inferences drawn from any of the above.
7-Eleven's own corporate 'About' page names 7-Eleven, Inc. as 'the premier name in the convenience-retailing industry,' based in Irving, Texas, and states it operates, franchises and/or licenses more than 13,000 stores in the U.S. and Canada under the 7-Eleven, Speedway, Stripes, Laredo Taco Company and Raise the Roost banners.
Seven & i Holdings Co., Ltd.'s own corporate history page states that in November 2005, 7-Eleven, Inc. was made a wholly owned subsidiary of Seven-Eleven Japan Co., Ltd., tracing 7-Eleven's US operating company to its Tokyo Stock Exchange-listed parent group.
The privacy notice self-declares CCPA rights covering both a 'sale' of Personal Information and a 'sharing' of Personal Information for cross-context behavioral advertising, and separately discloses that 7-Eleven may share data with 'Business Partners' such as social-media networks to facilitate loyalty-program participation and provide interest-based advertisements.
7-Eleven's privacy notice states that the company implements reasonable security measures, procedures and practices to protect Personal Information, while explicitly disclaiming any guarantee that data transmitted over the internet will remain secure; no breach found at draft time -- see the HIBP-sourced breach claim for a subsequently identified incident.
Have I Been Pwned's breach catalog lists the "7-Eleven" incident (7-eleven.com), breach date 2026-04-08, affecting approximately 185,256 accounts. Data classes exposed per HIBP: Dates of birth, Email addresses, Names, Phone numbers, Physical addresses. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
The privacy notice states that 7-Eleven's sites, apps, and marketing emails may use cookies or similar tracking technologies (including pixels and web beacons) to collect information about the user's browser, device, and activity, directing readers to a dedicated 'Cookies and Online Advertising' section for detail; the same notice discloses that the 7-Eleven App may separately ask for consent to share Bluetooth data about the user's device with in-store technologies.