Someone was inside Hibbett’s network for four days. That is the technical reality of the breach the Alabama sporting-goods chain has now disclosed: attackers had access between April 22 and April 25, 2026, and walked out with personnel records.
Hibbett, based in Birmingham, sells Nike, Jordan, Adidas, New Balance and HOKA through more than 1,100 Hibbett and City Gear stores, plus an online shop and an app. The stolen files are not customer data. They are the HR records the company keeps on current and former employees, along with their dependents and beneficiaries.
What was in the files
The company’s filing with the Texas Attorney General lists names, addresses, dates of birth, Social Security numbers, driver’s license numbers, other government ID numbers such as passport or state ID numbers, financial information such as account or card numbers, medical information and health insurance information. What any one person lost varies; each notification letter spells out the elements that apply to its recipient. The sample letter filed in California redacts them.
Under the hood, the combination is the problem. A Social Security number next to a date of birth and a driver’s license number is enough to open accounts in someone else’s name, and the health insurance details open a second door to medical identity theft.
How many people, and who has been told
The count has moved. Early coverage by Teiss said Hibbett had not yet fixed a total, though it told Texas regulators that about 15,223 Texans were hit. Wilshire Law Firm later pointed to the Texas report as listing 109,732 people overall, and Massachusetts as listing 640 residents. Hibbett also notified regulators in Vermont, Washington and other states. California posted the sample notice on September 8, and the Texas report went up the next day. Letters went out by U.S. mail in early September, roughly four and a half months after the intrusion.
Hibbett says it spotted suspicious activity, brought in outside forensic specialists, secured its systems, contained the disruption and told law enforcement. It has not said how the intruders got in. No group has claimed the attack, and the company has not said whether a ransom was demanded or how much data left the building.
It reported no evidence that the stolen information has been misused. Affected people are being offered a year of Experian IdentityWorks Credit 3B at no cost, covering credit monitoring at the three bureaus, identity restoration help and identity theft insurance. Each letter carries an activation code and an enrollment deadline, after which the code stops working.
Hibbett’s advice to those affected is the standard kit: watch credit reports and benefit statements, and report anything odd to police and the state attorney general. Wilshire Law Firm adds a few steps suited to HR files: a free credit freeze at Equifax, Experian and TransUnion, a check of health plan statements for claims nobody recognises, and an IRS Identity Protection PIN, since personnel records hold what a fraudster needs to redirect direct deposits or file a false tax return.
The one thing Hibbett has not put in writing is the full headcount, and the Texas figure of 109,732 is the largest number on the public record so far.
Sources
- Hibbett Retail says data breach exposed employee personal data
- Hibbett Retail Data Breach: Employee HR Records Involved
