Hibbett Retail, Inc. Data Breach Notice (California Attorney General)

The April 22, 2026 breach at Hibbett Retail, Inc. means that personal information belonging to an unknown number of California residents has been exposed. The company filed its notification with the California Attorney General on September 08, 2026 — 139 days later. That interval is the single most noticeable fact in the record.

Personal information cannot be replaced

The filing lists personal information as the category exposed in the incident. No passwords, no financial account numbers, and no permanent government identifiers beyond what the notification itself discloses were named. This is genuinely good news: nothing in the record indicates that login credentials for your Hibbett account were taken.

Because the exposed data consists of personal information, the primary long-term risk is identity theft or fraud that relies on accurate biographical details. A name combined with other personal data can be used to impersonate someone on loan applications, tax filings, or new account openings. Unlike a credit card, this information does not expire and cannot be reissued.

What the 139-day gap actually tells you

State law gives companies time to investigate and determine who was affected before they must notify residents. The record does not disclose when Hibbett discovered the incident, so it is impossible to know how much of the 139 days was investigation and how much was delay. The filing simply places the incident on April 22 and the submission on September 08. Readers can see both dates on this page and draw their own conclusions.

How to tell whether this breach includes you

Hibbett Retail, Inc. is required to notify affected individuals directly, usually by mail to the last known address. If you have not received a letter, it is likely your information was not part of the group included in this filing. However, anyone who has moved since April 22, 2026 should contact Hibbett directly to confirm whether their records were involved. Absence of a letter is meaningful but not absolute proof.

The difference between what was listed and what happened to you

The categories in the filing describe what the incident made available, not what every individual record contained. Your own notification letter, if you received one, is the only document that can tell you exactly which pieces of personal information left Hibbett’s control. Do not assume the full list applied to you.

Why this exposure stays relevant for years

Personal information retains value to identity thieves long after a breach fades from headlines. Criminals combine data from multiple incidents to build complete profiles. Because no passwords were exposed here, the breach does not put your existing Hibbett account at immediate risk of takeover. The concern is downstream use of the personal details themselves.

Concrete steps that address this specific exposure

• Place a fraud alert with the three major credit bureaus. A fraud alert requires lenders to verify your identity before opening new accounts in your name and lasts for one year.
• Monitor your credit reports for unfamiliar inquiries or accounts. You are entitled to one free report per bureau every twelve months; pull them from Equifax, Experian, and TransUnion and review them carefully.
• File your taxes early next year. This reduces the window in which someone could file a fraudulent return using your details.
• Be wary of unsolicited calls, texts, or emails claiming to be from Hibbett, banks, or government agencies. Verify requests for personal information through known official channels before responding.
• Keep the notification letter you received. It contains reference numbers and contact information that may be needed if identity theft occurs later.

The record is narrow. It tells us what category of data left Hibbett Retail’s systems on April 22, 2026 and when the company notified the state. Everything else — how the breach occurred, whether data was copied, and who exactly was included — remains undisclosed. Focus on the parts you can still control: vigilance around new credit applications and early tax filing. The letter in your mailbox remains the clearest signal of whether this incident applies to you.