BIRMINGHAM, September 15 — Hibbett Retail, Inc., the athletic footwear and sportswear chain, has confirmed a data breach that ran across four days in late April, and a national class action firm is now circling the case. The technical reality, as disclosed, is a window rather than a single hit. According to a press release issued by Edelson Lechtzin LLP on September 11, the intrusion at Hibbett Retail, Inc. occurred between April 22, 2026, and April 25, 2026.
That is the detail that matters: a multi-day dwell time, not a smash-and-grab. The firm’s announcement, distributed by PR Newswire from a Birmingham, Alabama dateline, says the breach may have exposed personal information belonging to current employees of Hibbett Retail, Inc. and its affiliated businesses, including City Gear and Sports Additions.
What may have been taken
The list of potentially compromised categories is broad, and it is the kind of inventory that makes identity theft investigations expensive. It may include names, addresses, Social Security numbers, driver’s license numbers, government-issued identification numbers, financial information, medical information, health insurance information, and dates of birth. Under the hood, that combination is worse than any single field.
Social Security numbers and government identification are the skeleton keys for opening new accounts; medical and health insurance records carry their own resale value on the secondary market. No specific number of affected individuals, no financial losses, and no confirmed cause of the breach has been disclosed in the source material.
The investigation remains ongoing, and no lawsuit has been filed as of the announcement. Edelson Lechtzin LLP, a national class action law firm with offices in Pennsylvania and California, said it is investigating data privacy claims arising from the breach and is evaluating a potential class action to pursue legal remedies on behalf of affected individuals. The firm is offering free case evaluations.
It can be contacted through Marc Edelson, Esq., at 411 S. State Street, Suite N-300, Newtown, PA 18940; by phone at 844-696-7492; by email at [email protected]; or via its website, www.edelson-law.com.
Hibbett’s footprint is the reason the employee exposure is not a small-town story. The company operates across a family of retail banners, and the notification letters are the trigger for legal risk. Individuals who received a data breach notification from Hibbett Retail, Inc. may face an increased risk of identity theft and fraud, the firm said.
The practical checklist
For anyone holding one of those letters, the advice is procedural and unglamorous. Edelson Lechtzin advises impacted individuals to review account statements and credit reports regularly, remain vigilant for suspicious activity, confirm whether their information was involved, preserve any breach notification letters or emails, and consider placing fraud alerts and credit monitoring. Preserving the notification itself is the step most people skip.
It establishes standing and a timeline if litigation proceeds. The firm’s practice is not confined to data privacy.
In addition to data breach litigation, Edelson Lechtzin LLP handles class and collective actions involving securities and investment fraud, federal antitrust violations, ERISA employee benefit plans, wage theft, and consumer fraud. What remains unanswered is the shape of the incident itself. The source material discloses no confirmed cause, which leaves open the usual suspects — an external intrusion, a vendor compromise, or something more mundane — without evidence for any of them.
The four-day span from April 22 to April 25 suggests either a persistent foothold or a slow discovery process, and the difference matters enormously to how liability is apportioned. Watch for the notification count and the forensic findings.
Those two disclosures will determine whether this stays a letter-writing exercise or becomes a certified class. As ever, the detail that matters is the one the company has not yet put in writing.
