Hibbett Retail, Inc., a Birmingham, Alabama-based retail company specializing in athletic-inspired fashion and sporting goods, experienced a data breach between April 22 and April 25, 2026. The company disclosed the incident on September 8, 2026, notifying the California and Vermont Attorneys General, with other state AGs also mentioned in public reporting.
The breach affected approximately 109,732 individuals overall, including 15,223 Texas residents and 510 Washington residents. The exposed data included names, addresses, dates of birth, Social Security numbers, driver’s license numbers, government-issued ID numbers (such as passport and state ID card numbers), financial account information (credit/debit card numbers), medical information, and health insurance information. The incident primarily impacted current employees of Hibbett and its affiliate companies. The company stated in its notice that it was unaware of fraud or identity theft tied to the incident.
Details regarding additional affected states or specific notification dates for all consumers may emerge as investigations continue. Official notices to affected individuals would have been provided following the disclosure.