Hibbett Data Breach Exposes PHI and PII Information of Employees

Hibbett Retail Inc., a Birmingham, Alabama-based sporting goods and athletic fashion retailer, disclosed a data breach that affected current employees of the company and its affiliate brands.

The breach was reported to the attorneys general of California, Indiana, South Carolina, Texas, Vermont and Washington starting on Sept. 8, 2026.

The data breach took place between April 22, 2026, and April 25, 2026. The incident could have resulted in unauthorized access to some personal information belonging to current employees of Hibbett or one of Hibbett's affiliate companies such as City Gear and Sports Additions.

The specific types of personal information that were involved included names, dates of birth, addresses, driver's license numbers, government ID numbers, financial account information, Social Security numbers, health insurance information and medical information.

The incident impacted a total of 109,732 individuals, including 15,223 residents of Texas, 3,187 of Indiana, 2,110 of South Carolina and 510 of Washington.

Hibbett's response to the breach

Hibbett is offering identity restoration services through Experian to individuals affected by the breach. Affected individuals received a unique engagement number to use as proof of eligibility when enrolling in the Experian services.

Individuals who are unsure whether they were affected by the breach should reach out directly to Hibbett.