Hibbett Retail, Inc.

Summary

Hibbett Retail, Inc. experienced a data breach over a brief period that may have exposed personal information belonging to current employees of the company and affiliated businesses, including City Gear and Sports Additions. The compromised data may include names, addresses, Social Security numbers, driver’s license numbers, government-issued identification numbers, financial information, medical information, health insurance information, and dates of birth. Individuals who received breach notifications may face increased risks of identity theft and fraud.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Hibbett Retail, Inc. experienced a data breach between April 22, 2026, and April 25, 2026. The incident affected Hibbett Retail, Inc. and involved personal information belonging to current employees of Hibbett and affiliated businesses. The affiliated businesses identified in the source material were City Gear and Sports Additions. The exposed information included names, addresses, Social Security numbers, driver’s license numbers, government-issued identification numbers, financial information, medical information, health insurance information, and dates of birth. The source material did not identify the attacker, the method used to access the information, the affected systems, or the date the incident was detected. It also did not describe containment steps taken by Hibbett Retail, Inc.

On September 11, 2026, Edelson Lechtzin LLP announced that it was investigating data privacy claims arising from the Hibbett Retail, Inc. cybersecurity incident. The firm stated that individuals who received a data breach notification from Hibbett Retail, Inc. could face an increased risk of identity theft and fraud. The law firm also stated that it was evaluating a potential class action on behalf of individuals whose sensitive personal data may have been compromised. Hibbett was described in the source material as a retailer specializing in athletic footwear, apparel, and fashion-focused sportswear. The incident’s confirmed impact was the possible exposure of employee and affiliated-business employee personal information, including highly sensitive identity, financial, medical, and insurance-related data.

Sources

Sources available to members: 1 source.