The Qilin ransomware group listed Don Tortaco Mexican Grill on its leak site on July 19, 2026, claiming a data breach and exfiltration of internal files. As of July 20, 2026, the company has not issued an official public statement or breach notification.
The specific number of affected individuals and the detailed types of data exposed, such as SSNs, medical, or financial information, have not been publicly confirmed by the company. The ransomware group's claim only indicates "internal files" were compromised. No state Attorney General filings have been found in Maryland, California, Texas, or South Carolina.
Details can emerge later as the situation develops. Official company statements or regulatory notifications, which typically follow within weeks or months of discovery, have not yet been released.