Hibbett Retail Reports 2026 Data Breach in Washington State

Hibbett Retail, Inc. has officially reported a data security incident to the Washington Attorney General's office on September 8, 2026. As a major retailer in sporting goods and athletic footwear, Hibbett processes a substantial volume of customer data through its stores and e-commerce platforms. This recent breach highlights potential vulnerabilities within the company's digital infrastructure that allowed unauthorized access to sensitive information.

While the specific cause of the breach remains under investigation, incidents of this nature in the retail sector often stem from sophisticated cyberattacks. These can include unauthorized network intrusions, credential stuffing, or compromises affecting third-party vendors integrated into online shopping and customer service systems. Such attacks can expose gaps in an organization's security defenses, enabling malicious actors to access customer databases and extract private data.

The information potentially exposed in this incident includes customers' Full Name, Email Address, Password or Credential Hash, Mailing Address, Purchase and Order History, Payment Card Information, Phone Number, and Loyalty Account Details. The compromise of such data creates serious risks, including the potential for unauthorized transactions using payment card details, and credential-stuffing attacks where leaked email and password combinations are used to access other online accounts.

Hibbett Retail, Inc. is subject to various regulations, including Washington's Consumer Protection Act, which mandate reasonable security practices to protect consumer data. The occurrence of a data breach suggests that these security safeguards may have been insufficient. Such shortcomings can form the basis for legal claims, as companies are expected to protect the personal information they collect from their customers.

Receiving a formal data breach notification letter from Hibbett Retail, Inc. confirms that your personal information was compromised. This notification establishes your standing to consider legal action against the company. You do not need to show immediate financial loss or fraudulent charges to pursue legal remedies; the increased risk of future identity theft and the violation of your privacy can be sufficient grounds for a claim.

If you received a data breach notification from Hibbett Retail, Inc., you may be entitled to compensation. We are currently evaluating cases for individuals affected by this breach and offer a free, no-obligation case review to help you understand your legal options.