Panera Data Breach Class Action Voluntarily Dismissed by Plaintiffs

According to court records filed earlier this week in Illinois federal court, the plaintiffs who filed a data breach class action lawsuit against Panera Bread Company have agreed to voluntarily dismiss their case.

The Panera Bread class action lawsuit was filed on April 5, just three days after the alleged data breach was reported by the cybersecurity blog Krebs on Security.

The data breach reportedly involved an eight-month leak of data that exposed the names, emails, addresses, birthdates, and the last four digits of credit cards of consumers who participated in Panera’s rewards program.

Panera responded to the report by saying it had resolved the issue and that the data breach affected fewer than 10,000 customer records.

According to the Panera Bread class action lawsuit, the company knew about the Panera data breach for at least eight months but failed to address the vulnerability of its systems. The plaintiffs claim Panera failed to protect customer data against “reasonably foreseeable threats.”

“Panera has not fully disclosed the data leak on its website as of the time of the filing of this civil action,” the Panera data breach class action lawsuit says. “Upon information and belief, Panera has taken no other efforts since discovering the security breach to inform customers that their Personal Identifying Information was leaked and/or compromised.”

As a result of the alleged Panera data breach, customers were at increased risk of fraudulent credit card charges, identity theft, and other harm. In some cases, it can take victims of identity theft months or years to resolve the issues.

The plaintiffs claim that they were made vulnerable to identity theft and credit card fraud because Panera failed to take action despite “well-publicized litigation and frequent public announcements of data breaches by retailers,” instead choosing to “maintain an insufficient and inadequate system to protect the Personal Identifying Information of plaintiffs and class members.”

The Panera Bread data breach class action lawsuit asserted claims for negligence, violation of the Illinois Consumer Fraud and Deceptive Business Practices Act, breach of contract, and invasion of privacy.

The plaintiffs sought to represent a nationwide Class of Panera customers who were affected by the Panera data breach. They also sought to represent Classes of consumers in Illinois, Tennessee and Minnesota.

An attorney representing the plaintiffs noted that they voluntarily dismissed the Panera class action lawsuit because none of the named plaintiffs were affected by the data breach. U.S. District Judge John J. Tharp Jr. dismissed their claims without prejudice, struck any scheduled hearings and denied as moot all pending motions.

The plaintiffs are represented by James Vlahakis of Sulaiman Law Group Ltd.

The Panera Bread Data Breach Class Action Lawsuit is Alisha Boykin, et al. v. Panera Bread Company, Case No. 1:18-cv-02461, in the U.S. District Court for the Northern District of Illinois, Eastern Division.