HUT American Group LLC, a Pizza Hut franchise operating entity under the Flynn Group umbrella, recently disclosed a data security incident affecting individuals whose personal information the company maintained. The company reported the breach to the Texas Attorney General’s Office, confirming that sensitive personal data was compromised and that affected individuals are entitled to know what happened and what steps they can take to protect themselves.
HUT American Group’s Data Breach Investigation
HUT American Group LLC filed a data breach notification with the Texas Attorney General’s Office disclosing a security incident affecting at least 3,528 Ohio residents. HUT American Group operates as part of Flynn Group, one of the largest franchise operators in the country, which also controls Apple American Group (Applebee’s) and Wend American Group (Wendy’s); given the scale of Flynn’s operations across multiple states, the true nationwide total of affected individuals is likely considerably higher than the Ohio-specific figure reported here. The notice identified an unusually broad range of exposed data categories, including home addresses, Social Security numbers, driver’s license numbers, other government-issued identification numbers, financial account or credit/debit card information, medical information, health insurance information, and dates of birth, suggesting the incident may have touched multiple internal systems used to manage employee payroll, benefits, and human resources records across the company’s restaurant operations.
Large-scale restaurant franchise operators like HUT American Group maintain extensive troves of personal data on their workforce, including payroll records, benefits enrollment and health insurance information, and government-issued identification collected during employment eligibility verification. When a breach compromises this range of information, the risk to affected individuals extends across nearly every category of identity-related harm: stolen Social Security numbers and driver’s license numbers can enable identity theft and fraudulent account openings, exposed financial account information can lead to unauthorized transactions, and compromised medical and health insurance information can be misused to fraudulently obtain healthcare services or file false insurance claims in a victim’s name.
According to the notice filed with the Texas Attorney General’s Office, HUT American Group confirmed that notice was provided to affected consumers via U.S. Mail. Companies operating large workforces across multiple states are expected to maintain security measures sufficient to protect sensitive employee data from unauthorized access. When those measures fail, the resulting exposure of Social Security numbers, government ID numbers, financial data, and medical records can create risks that persist for years, since this combination of data is highly valuable to identity thieves and can be resold and misused repeatedly.
As is typical with breach notifications filed with state regulators, the publicly available notice does not identify the specific technical cause of the incident, such as whether it involved a ransomware attack, a phishing scheme, or unauthorized access to an internal HR or payroll system. What is confirmed is that HUT American Group reported the incident to Texas regulators as required by law, and that the categories of information involved span nearly the full range of data types used in identity theft, financial fraud, and healthcare fraud schemes. Individuals connected to HUT American Group who are concerned their information may have been involved in this incident should review any formal notification they receive from the company and take the protective steps outlined below.
When Did This Breach Occur?
The exact date the breach occurred or was discovered has not been publicly disclosed in the notice filed with the Texas Attorney General’s Office. The notice was published to the Texas Attorney General’s data breach report list on August 21, 2026. As more information becomes available about the timeline of this incident, this page will be updated accordingly.
What Information Was Breached?
Based on the notice filed with the Texas Attorney General’s Office, the categories of personal information involved in this breach include home addresses, Social Security numbers, driver’s license numbers, other government-issued identification numbers, financial account or credit/debit card information, medical information, health insurance information, and dates of birth. This unusually broad combination of sensitive data is highly valuable to identity thieves and fraudsters, since it enables both direct financial fraud and impersonation across financial, medical, and government systems.
What You Can Do
If you have received a notice that your information was affected by the HUT American Group data breach, or believe your data may have been compromised, there are several steps you can take to protect yourself. Closely monitor your bank and credit card statements, as well as any medical bills or insurance explanation-of-benefits statements, for unfamiliar activity, and report anything suspicious immediately. Consider placing a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, and TransUnion) to make it harder for identity thieves to open new accounts in your name. Regularly review your credit reports for accounts or inquiries you don’t recognize, and consider contacting your state’s driver’s license agency if your license number was exposed. Be cautious of phishing emails or phone calls referencing this breach, since scammers sometimes exploit real breach news to trick victims into revealing additional information. If HUT American Group is offering free credit monitoring or identity protection services in connection with this incident, consider enrolling.
File a Data Breach Lawsuit Against HUT American Group
If your personal information was compromised in the HUT American Group data breach, you may be entitled to compensation. Companies that collect and store sensitive personal, financial, and medical information have a legal obligation to protect that data using reasonable security measures, and when they fail to do so, affected individuals may have grounds to pursue legal action.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
