Zullas LC dba Caf√© Zupas LC Data Breach — Class Action Review

Zullas LC, operating as Café Zupas LC, is a prominent fast-casual restaurant chain known for its made-from-scratch soups, salads, and sandwiches, serving communities across multiple states, including Maryland. To support its extensive operations, loyalty programs, online ordering platforms, and corporate workforce, the company routinely collects and stores a significant volume of personal data. This includes sensitive information from both loyal customers who utilize digital ordering apps and employees who handle daily restaurant operations. Because modern hospitality businesses rely heavily on digital infrastructure for point-of-sale transactions, payroll processing, and customer relationship management, they become prime repositories for valuable personally identifiable information.

In 2025, Zullas LC dba Café Zupas LC reported a data security incident to the Maryland Attorney General, signaling a breach of its digital network. In incidents affecting restaurant and retail operations, breaches frequently involve unauthorized actors infiltrating enterprise databases, compromising third-party vendor systems, or deploying malware designed to harvest transaction records and employee files. Whether stemming from sophisticated cyberattacks, credential stuffing, or vulnerabilities within integrated payment and inventory networks, these security failures allow unauthorized third parties to dwell undetected within corporate environments, siphoning off confidential data before detection occurs.

The exposure resulting from this incident encompasses a dangerous combination of customer and personnel data, each category carrying distinct and severe risks. If customer payment card information, online account credentials, and purchase histories were compromised, victims face immediate threats of financial fraud, unauthorized charges, and account takeover. Meanwhile, for employees whose sensitive records—such as names, dates of birth, and Social Security numbers—may have been accessed, the risks extend to long-term identity theft, fraudulent tax filings, and unauthorized credit applications. The mingling of consumer and worker data within a single breach compounds the potential for widespread and lasting financial injury.

As a commercial enterprise handling sensitive consumer and employee data, Zullas LC dba Café Zupas LC operated under a strict legal duty to implement reasonable security measures to safeguard this information against unauthorized access and exfiltration. Under state consumer protection statutes, the Maryland Personal Information Protection Act, and common law negligence principles, companies are required to maintain robust cybersecurity protocols, including encryption, regular vulnerability assessments, and secure vendor management. The occurrence of a data breach strongly indicates a failure to maintain these foundational security standards, leaving the company legally accountable for the resulting exposure of private data.

For Maryland residents who have received a data breach notification letter from Zullas LC dba Café Zupas LC, the notice serves as an official admission that your confidential information was compromised due to inadequate corporate security. Legally, the receipt of this letter establishes standing to participate in a class action lawsuit aimed at holding the company accountable for its security lapses. Importantly, affected individuals do not need to prove that they have already suffered actual financial fraud or out-of-pocket losses to join the litigation; the increased risk of future identity theft and the loss of data privacy are recognized harms. Our firm evaluates and litigates these data breach cases on a strict contingency fee basis, meaning there are never any out-of-pocket costs or fees unless we successfully recover compensation on your behalf.