Café Zupas, a Utah-based fast-casual restaurant chain, has disclosed a data breach that exposed customers’ sensitive personal information, including Social Security numbers, during a network intrusion in October 2024.
The company detected suspicious activity within its computer systems and immediately launched an investigation with external cybersecurity specialists. The investigation revealed that unauthorized actors accessed portions of Café Zupas’ network between October 21 and October 23, 2024.
According to the Vermont Attorney General’s office, which has historically taken a strong stance on data privacy violations, Café Zupas filed its official breach notification on February 25, 2025. The timing of this notification aligns with state requirements for prompt disclosure of data breaches affecting residents.
The compromised information includes names and Social Security numbers of affected individuals. While the total number of impacted customers has not been disclosed, the breach affects individuals across the company’s operations in 15 states. Café Zupas, which generates approximately $248 million in annual revenue and employs over 3,680 people, operates more than 70 locations nationwide.
In response to the breach, Café Zupas has begun sending notification letters to affected individuals and is offering complimentary credit monitoring services. This response comes amid increasing regulatory scrutiny of data privacy incidents and growing concerns about identity theft risks.
“While we have no evidence of identity theft or fraud resulting from this incident, we are taking proactive steps to protect affected individuals,” stated Café Zupas in their official notification. The company emphasized that information security remains one of their highest priorities.
The company has implemented additional security measures and is working with cybersecurity experts to prevent similar incidents in the future.
Sources: JD Supra, Strauss Borrelli, Massachusetts Government Documents
—
February 28, 2025 – by the ID Tech Editorial Team
