Panda Express parent faces class action over data breach

Panda Express data breach class action lawsuit overview:

• Who: Plaintiff Emily Flessas filed a class action lawsuit against Panda Restaurant Group Inc.
• Why: Flessas claims a data breach compromised her personally identifiable information.
• Where: The Panda Express class action lawsuit was filed in California federal court.

The parent company of restaurant chain Panda Express faces a class action lawsuit alleging it failed to properly secure sensitive employee data, leaving it vulnerable to cybercriminals who accessed the company’s systems in March.

Plaintiff Emily Flessas says Panda Restaurant Group Inc. sent her a data breach notice April 29.

On March 10, Panda reportedly discovered an unauthorized actor accessed its corporate systems March 7-11. Upon investigation, Panda concluded the breach exposed employees’ sensitive information such as first and last names, Social Security numbers, birthdates and financial account numbers.

Flessas claims the Panda Express data breach disclosure failed to provide enough information about the incident, diminishing her ability to mitigate the resulting harm. She says she suspects the threat actor sold her  personally identifiable information (PII) on the dark web.

Panda reportedly offered 12 months of identity monitoring services, which Flessas says is inadequate because she and other Panda Express data breach victims will face the risk of identity theft and fraud for many years to come. After the service expires, Flessas says class members will have to pay out of pocket for identity monitoring services.

Panda Express class action says data breach preventable

Flessas claims Panda’s failure to implement adequate data security measures to protect current and former employees’ data left it vulnerable to cybercriminals.

“[Panda] could have prevented this data breach by, among other things, properly encrypting or otherwise protecting their equipment and computer files containing PII,” the Panda Express class action lawsuit alleges.

Panda’s failure to safeguard sensitive data runs afoul of U.S. Federal Trade Commission guidelines and industry standards, the class action lawsuit alleges.

Flessas says the Panda Express data breach compromised the PII of “thousands to tens of thousands” of current and former employees.

The lawsuit asserts claims for negligence, breach of implied contract, unjust enrichment and violations of California’s Unfair Competition Law.

Last year, a $1.4 million Panda Express class action settlement resolved allegations the restaurant chain charged illegal service fees on delivery orders.

Were you affected by the Panda Express data breach? Tell us about your experience in the comments.

Flessas is represented by John J. Nelson of Milberg Coleman Bryson Phillips Grossman PLLC.

The Panda Express data breach class action lawsuit is Emily Flessas v. Panda Restaurant Group Inc., Case No. 2:24-cv-03867, in the U.S. District Court for the Central District of California.

Read About More Class Action Lawsuits & Class Action Settlements:

• Arby’s franchise class action claims data breach exposed employees info
• Dell data breach exposes customer names, addresses
• Accounting firm hit with class action over data breach affecting 1M+
• Kaiser Permanente data breach may affect 13M+ patients