Hibbett Retail, Inc. disclosed a data security incident to state Attorneys General, including Vermont, following unauthorized access to its systems. The company reported that employee records were affected, and notices were sent to impacted individuals, with a notification letter described as dated September 8, 2026.
The breach affected an estimated 109,732 individuals, with specific numbers reported for Texas (15,223), Washington (510), and Vermont (at least 6). The exposed data includes names, dates of birth, addresses, driver’s license numbers, government ID numbers, financial account information, Social Security numbers, health insurance information, and medical information. The exact date the company discovered the breach has not been publicly disclosed.
State Attorney General filings were made in Texas, Vermont, and Washington. Law firms are investigating potential class action lawsuits, indicating active litigation interest. Details regarding any further regulatory actions or the outcome of investigations may emerge over time.