In April 2026, 7-Eleven experienced a significant data breach that exposed 185,300 people’s personal information. The attack was a “pay or leak” extortion by the infamous ShinyHunters group. After 7-Eleven refused the ransom, the hackers released a 9.4GB archive of stolen data.
Notification of data breaches, according to Have I Been Pwned, proclaimed that around 185,000 persons were impacted by a 7-Eleven convenience store chain data breach that included their names, dates of birth, and physical addresses.
The email addresses and phone numbers were also included in the data breach, which was discovered sometimes in April.
7-Eleven was the target of a hack and extortion attack, according to a recent report from Have I Been Pwned, which gathers caches of data breaches and notifies impacted individuals that their data was exposed. The ShinyHunters organisation claimed responsibility for the hack and threatened to release the information if they weren’t compensated.
Jim Kastle, the chief information security officer for 7-Eleven, stated in a listing with the attorney general’s office of Maine that the hackers were able to access an internal server that held franchisee documents. Social Security information and driver’s licenses were allegedly compromised, according to a different listing with the Massachusetts attorney general.
Also, reports shared with the Maine Attorney General’s Office and cybersecurity trackers such as Sherlock Forensics indicate that the breach affected 7-Eleven systems that stored franchisee documents and Salesforce records, exposing names, addresses, emails, phone numbers, and dates of birth. Although the attackers initially claimed to have accessed 600,000 records, verification revealed that 185,300 distinct individuals are impacted.
Security analysts at SOC Defenders have urged that the affected 7-Eleven franchisees, employees, and associates watch for phishing attempts using their personal details, change passwords on any accounts linked to 7-Eleven systems, monitor financial statements and credit reports for unauthorized and for unsuspected activities, and check major data breach sites or wait for official notification letters from 7-Eleven regarding identity theft protection services.