RB American Group LLC, an Arby's franchisee and subsidiary of Flynn Restaurant Group LP, discovered suspicious activity on its network on April 9, 2026. An investigation revealed an unauthorized actor accessed a portion of the company’s network between April 8 and April 9, 2026. During this period, files containing sensitive information may have been accessed or copied.
The breach potentially exposed the personal information of 66,608 individuals. Exposed data includes names, Social Security numbers, driver's license or Washington ID card numbers, financial and banking information, credit and debit card numbers, full dates of birth, unique private keys, student ID numbers, military ID numbers, passport numbers, health insurance policy or ID numbers, medical information, biometric data, usernames, passwords, security question answers, email addresses, and taxpayer ID numbers. Notification to affected individuals began on August 28, 2026, including specific mentions of 974 Washington residents and 4 Massachusetts residents.
Details can emerge later, and notices may be delayed as investigations continue.