Panera Bread (privacy-policy operator named as 'Panera Bread Company or its subsidiaries'; iOS app seller named as 'Panera, LLC') is one of three restaurant brands under Panera Brands, a private holding company formed in 2021 that also owns Caribou Coffee and Einstein Bros. Bagels; Panera Brands' own site does not name a further parent, though the company is widely reported (outside this research's sourced primary pages) to be backed by JAB Holding. Panera's privacy policy (last updated August 1, 2026) discloses an extensive list of collected categories — contact, payment, commercial/purchase, marketing-engagement, demographic, nutrition-preference, device/browser, geolocation (including in-cafe Bluetooth-based device presence detection), and audio/visual data from drive-thru and voice-ordering interactions — and states this data is disclosed to affiliates/franchisees, service providers, analytics partners (including Google), marketing/advertising partners including social media networks and third-party advertising networks, and explicitly to 'third-party data providers, including data aggregators and data brokers.' The policy self-declares a CCPA right to opt out of the 'sale or sharing' of personal information via Global Privacy Control signals. The iOS app's App Store label confirms precise location, purchase history and contact info used for the developer's own advertising/marketing, with no 'Data Used to Track You' category declared. Have I Been Pwned's breach catalog lists a Panera Bread (panerabread.com) breach dated January 7, 2026, affecting approximately 5,112,502 accounts, with email addresses, names, phone numbers, and physical addresses exposed. No primary source (company statement or regulator page) describing the widely-reported 2018 customer-data exposure could be located within this research's budget, so it is not cited as a claim.
TRACK RECORD
1 BREACH
[2026-01-07] · BREACH
Have I Been Pwned lists a breach record for Panera Bread: "Panera Bread".
Approximately 5,112,502 accounts affected, per HIBP.
Panera's privacy policy states it collects Commercial Information (items searched, viewed, purchased, purchase frequency and cost), Nutrition Information (dietary preferences), Audio/visual information (recordings of phone calls, voice ordering, and drive-thru interactions where permitted by law), and General Geolocation information including Bluetooth-based device-presence detection in its cafes, in addition to standard contact, payment, demographic and device/browser data.
The Panera Bread iOS app's App Store listing names the seller as 'Panera, LLC,' a named operating entity consistent with the privacy policy's identification of 'Panera Bread Company or its subsidiaries' as the entity responsible for personal-information handling.
Panera Brands' own corporate page states that Panera Brands was formed in 2021 and is comprised of Panera Bread, Caribou Coffee and Einstein Bros. Bagels, describing itself as one of the largest fast-casual restaurant platforms in the U.S. with nearly 4,000 locations; no further parent company or ownership stake is named on the page.
Panera's privacy policy discloses personal information to 'third-party data providers, including data aggregators and data brokers,' and separately to 'marketing and advertising partners, including social media networks, third-party advertising networks, and other parties that assist us in serving, creating custom audiences, measuring the performance of, and optimizing our advertising campaigns.'
Have I Been Pwned's breach catalog lists the "Panera Bread" incident (panerabread.com), breach date 2026-01-07, affecting approximately 5,112,502 accounts. Data classes exposed per HIBP: Email addresses, Names, Phone numbers, Physical addresses. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
Panera's privacy policy states only that it 'maintains reasonable physical, electronic, and procedural safeguards' and cannot guarantee the security of transmitted information, generic safeguards language rather than a description of any specific past incident, audit, or certification; no primary source describing the 2018 customer-data exposure reported in the press was found within this research's budget.
The Panera Bread iOS app's App Store privacy label states that Precise Location, Coarse Location, Purchase History and Contact Info (Physical Address, Email Address, Name) linked to the user's identity are used for the developer's own advertising or marketing purposes, and again for first-party analytics; no 'Data Used to Track You' category is declared.