Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Panda Restaurant Group, the parent company of Panda Express, Panda Inn and Hibachi-San, disclosed that an unauthorized actor accessed certain corporate systems between March 7 and March 11, 2024. Panda said the incident did not affect in-store systems, restaurant operations or the guest experience. The information involved current and former associates—Panda’s term for employees and other workers—not ordinary restaurant customers.
The number of affected people was not disclosed in the company’s initial announcement. Later litigation and settlement coverage reported that the affected class approached 240,000 people, but that figure should not be confused with Panda’s original regulatory disclosures.
What happened in the Panda Restaurant Group breach?
Panda Restaurant Group said an unauthorized actor accessed information in certain corporate systems during a period beginning March 7, 2024. Panda detected the incident on March 10 and said it secured its environment, began remediation and recovery, hired outside cybersecurity specialists, worked with law enforcement and reviewed the affected information.
The company’s individual notice said the incident did not affect in-store systems, restaurant operations or the guest experience. Panda also told contemporaneous reporters that no guest data was involved. The available evidence therefore supports describing this as a corporate and workforce-data incident, rather than a breach of Panda Express customer accounts or restaurant payment systems.
#1 Best Overall
- 【Cross Cut & Credit Card Paper Shredder】The cross cut shredder shreds paper into 5x14mm particles, achieving P-4 level security. Shreds up to 6 sheets at once without removing staples, also handling paper clips and credit card (one at a time)
- 【Continuous Performance】The operating time is 4 minutes, with a 20-minute cooling cycle. If the shredding time exceeds 4 minutes, the overheating indicator will light up. After a 20-minute cooling cycle, it can resume operation
- 【Easy to Clean & Place】 Bonsaii shredder’s head features a handle for easy lifting; the separate 3.4-gallon bin has a clear window for quick disposal. Compact dimensions (11.81" × 7.09" × 14.26") make it perfect for home and small office spaces, fitting neatly under desks.
- 【Easy Operation & Safety Features】Auto start/stop and manual-reverse functions protect the paper shredder from the frustration of paper jams. The overheat protection function effectively extends the lifespan of the shredder, The document shredder will stop working once you lift the head, ensuring your safety.
- 【1-Year Warranty】Bonsaii offers a 1-year warranty for your shredders for home use heavy duty. If you have any questions, please feel free to contact us. We test every shredder before shipping, so you may notice some paper shreds from the testing
The primary notices establish unauthorized access. They do not establish that every record was exfiltrated, published or misused. They also do not identify an attacker, root cause, ransom demand or ransomware deployment.
BleepingComputer’s contemporaneous report covered Panda’s disclosure and its statement that restaurant operations and guest information were not affected.
Incident timeline
| Date | What happened |
|---|---|
| March 7, 2024 | The Maine regulatory filing identifies this as the earliest date of the breach occurrence. |
| March 7–11, 2024 | Panda’s individual notice describes the period during which an unauthorized actor accessed information. |
| March 10, 2024 | Panda detected the data-security incident. |
| April 15, 2024 | Panda completed its review of the affected data and determined that the recipient’s personal information was involved. |
| April 30, 2024 | Written notices were sent to affected Maine residents. |
| May 1, 2024 | BleepingComputer reported the corporate-systems breach publicly. |
| May 16, 2024 | Later litigation coverage identifies the filing of a proposed class action. |
| 2026 | Settlement materials listed deadlines for claims, objections and opt-outs, plus an April 20 final-approval hearing. |
The Maine Attorney General’s filing supplies the most specific early regulatory details.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhose information was involved?
Panda said the affected information belonged to current and former associates. In this context, “associate” is Panda’s terminology for employees or workers. The available notices do not describe a general compromise of Panda Express diners or other restaurant guests.
Rank #2
- Cross-cut paper and credit card shredder cuts material into approximate 0.2 x 1.2 inches (5 x 30 mm) pieces; meets security level P-3 standards
- Shreds up to 12 sheets of 20-pound bond paper at a time, also can shred credit cards (one at a time, but not suitable for metal credit cards), staples, and small paper clips
- 9 minute runtime and 30 minute cool down; if unit goes over max run time, it automatically shuts off to prevent overheating
- 4 mode control switch (auto/on, off, reverse, forward) and LED status indicators for power on, overheat and overload; 5 gallon bin reduces empty frequency
- Quality tested: As part of Amazon Basics quality inspections, we test every shredder before shipping it, which means you may see some paper shreds from the testing
The Maine filing reported 64 affected Maine residents. It listed the national total as “N/A” at the time of that filing, so the Maine figure should not be treated as the size of the nationwide incident.
What information was exposed?
The strongest primary evidence—the Maine filing and Panda’s individual notice—supports the following data elements for the affected Maine residents:
- Names or other personal identifiers
- Driver’s-license numbers
- Non-driver identification-card numbers
The individual notices used variable fields. That means the exact information involved could differ from one recipient to another.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteLater litigation and settlement materials describe a broader class involving full names, dates of birth and Social Security numbers. Those additional categories should be attributed to the later legal materials and should not be assumed to apply to every affected person.
Rank #3
- P-4 Level Security: Crosscut shredder for home office heavy duty can handle 12 sheets effortlessly per pass, make sure your important documents are securely shredded, can shred paper, credit card, staple or clips into 13/64*51/64 inches (5*20mm) tiny particles.
- 6-Minute Continuous Shredding: Based on the patented cooling system, Bonsaii paper shredder for home use heavy duty can run continuously for up to 6 minutes without worrying about overheating or slowing down, ideal paper shredder for home office use or small office use.
- Easy Operation & Safe Protection: Auto start/stop and manual-forward/reverse function protect the paper shredder heavy duty from the frustration of paper jams. Overheat protection helps you use paper shredder without worrying and prolong its lifetime. The document shredder will stop working once you lift the head, keeping you safe.
- Compact Sizes: The shredder for home office comes with a portable handle on the shredder head and a 5.5 Gal large transparent window wastebasket; with the compact size of 12.6*7.91*18.3 inches, you can place it in the corner or under the desk, it's perfect for home use or office use.
- Professional Service: Bonsaii provides 1-Year limited warranty for your shredders for home office heavy duty. If you have any questions, please get in touch with us.
There is no reliable basis in the supplied primary materials for saying that Panda restaurant customers’ payment-card data was exposed. Panda said no guest data was involved.
How many people were affected?
Panda had not disclosed a national total when the breach was first reported in May 2024. The Maine filing identified 64 affected Maine residents but did not provide a national figure.
Later lawsuit and settlement coverage reported that the affected class included nearly 240,000 people. That is a later litigation-related figure, not a number Panda announced in its initial breach disclosure. It also should not be described simply as “240,000 Panda employees,” because the settlement class and the company’s original regulatory population are not necessarily identical.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Later litigation reporting provides the nearly 240,000-person estimate, while the official settlement website describes the settlement class and benefits.
Rank #4
- Basketless paper and plastic shredder for safely destroying material into 0.24 inch wide strips; meets security level P-2 standards
- Fits over most waste baskets; extendable arm max length is 16.7" or 42.4 cm
- Accepts up to 8 sheets of 20-pound bond paper at a time (no need to remove staples or small paper clips)
- Destroys CDs, DVDs, and credit cards (one at a time, through dedicated slot; blades cut each disc into 3 pieces).
- Run time is 2.5 minutes on/15 minutes off (9.84 feet per minute); if shredder runs continuously beyond max run time, it will automatically shut off to protect the motor from overheating
What did Panda do after discovering the breach?
According to Panda’s notice, the company:
- Secured its environment
- Started remediation and recovery
- Investigated with third-party cybersecurity specialists
- Worked with law enforcement
- Reviewed the affected data to identify people whose information was involved
- Added technical safeguards intended to reduce the risk of a similar incident
Panda said there was no evidence of misuse at the time it sent the notice. That statement describes what the company knew then; it is not proof that misuse could never occur later.
What identity-protection assistance was offered?
The Maine filing says Panda offered identity-theft protection through Epiq eDiscovery Solutions using CyEx Identity Defense Total – 3 Bureau. The individual notice describes credit reports, credit monitoring, identity-restoration support and fraud-resolution assistance. The monitoring period varied by recipient notice and was shown as either 12 or 24 months.
The later settlement website describes a separate benefit: two years of three-bureau credit monitoring, dark-web scanning, identity-theft insurance and fraud-resolution assistance. The original breach-notice service and the later settlement benefit are different programs and should not be treated as interchangeable.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Lawsuit and settlement status
The official settlement website describes a lawsuit arising from the incident and lists the following historical dates:
Best Value
- Crosscut paper and credit card shredder destroys your sensitive documents
- Shreds credit cards, paper clips and staple
- 8-sheet capacity
- 8.7-inch throat width
- Measures 12 x 7 x 16 inche
- March 23, 2026: Deadline to opt out or object
- April 10, 2026: Claims deadline
- April 20, 2026: Final-approval hearing listed by the settlement website
Those deadlines have passed. The available settlement-site material does not confirm the final disposition after the April 20 hearing, so readers should not be told that the settlement was finally approved or that late claims remain available without a current court order or administrator update.
There is also a date inconsistency that remains unresolved: the settlement website refers to a security incident occurring “in or around March 2023,” while Panda’s Maine filing and individual notice identify the access period as March 7–11, 2024. Those dates should not be silently treated as the same event without clarification from Panda, the court or settlement counsel.
What affected people should do
- Find the original notice. Check which data elements were listed for you. Exposure was not necessarily identical for every recipient.
- Use the notice’s official enrollment instructions. If your individual monitoring deadline has not passed, enroll using the contact details printed in the notice.
- Consider a credit freeze. A freeze can restrict new-credit inquiries and is generally stronger than monitoring alone when Social Security, driver’s-license or state-ID information may be involved. Contact each major credit bureau directly through its official website.
- Review your credit reports and accounts. Watch for unfamiliar credit activity, bank transactions, payroll changes, tax activity and new-account notifications.
- Be alert for employment-themed scams. Exposed workforce information can make payroll-diversion, employment-verification and identity-confirmation phishing attempts more convincing.
- Verify settlement communications independently. Use only the official settlement website or contact information from your original notice. Treat unsolicited requests for a Social Security number, settlement PIN, payment or gift card as suspicious.
Credit monitoring can help identify suspicious activity, but it cannot prevent misuse of an already exposed identifier and does not replace a credit freeze. These precautions are sensible protections, not evidence that Panda’s data was later misused.
What remains unknown
- The attacker’s identity
- The initial access method or root cause
- Whether all accessed information was exfiltrated or published
- Whether a ransom was demanded
- The exact national count in Panda’s own regulatory disclosures
- Whether the listed settlement received final approval, and on what terms
For the most concrete primary details, consult the Panda individual breach notice, the Maine filing and the official settlement website.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
