Hy LaBonne & Sons Inc. and LaBonne’s Markets: LaBonne's Markets Data Breach: Social Security Numbers Exposed

LaBonne’s Markets Data Breach Exposes Personal Information of Dozens in New England

LaBonne’s Markets, a Connecticut-based grocery chain owned by Hy LaBonne & Sons Inc., disclosed a data breach affecting consumers across multiple states. The incident came to light after the PLAY ransomware group claimed responsibility on October 26, 2025, posting a threat on the Tor network to publish stolen data within three days.

The company’s regulatory filing in May 2026 over six months after the initial dark web posting revealed that exposed data included names and Social Security numbers. However, the disclosure did not specify when the breach occurred, how attackers gained access, or when the intrusion was discovered.

So far, 67 Massachusetts residents and 10 Vermont residents have been confirmed as affected. In response, LaBonne’s Markets is offering 24 months of free credit monitoring and identity theft protection through Experian IdentityWorks, including daily credit reports, fraud monitoring, identity restoration support, and $1 million in identity theft insurance. The offer also includes ExtendCARE, which provides continued restoration assistance after the membership expires.

Affected individuals must enroll by July 31, 2026, using a unique activation code provided in their notification letter. For assistance, they can contact Experian at 833-918-9003 or write to LaBonne’s Markets at its Woodbury, CT, address.

Source: https://www.claimdepot.com/data-breach/labonnes-2026

LaBonne's Markets cybersecurity rating report: https://www.rankiteo.com/company/labonne's-markets

"id": "LAB1778092492",
"linkid": "labonne's-markets",
"type": "Ransomware",
"date": "10/2025",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '77 (67 Massachusetts residents, '
                                              '10 Vermont residents)',
                        'industry': 'Retail',
                        'location': 'Connecticut, USA',
                        'name': 'LaBonne’s Markets',
                        'type': 'Grocery Chain'}],
 'customer_advisories': 'Offering 24 months of free credit monitoring and '
                        'identity theft protection through Experian '
                        'IdentityWorks, including $1 million identity theft '
                        'insurance and ExtendCARE restoration assistance. '
                        'Enrollment deadline: July 31, 2026.',
 'data_breach': {'data_exfiltration': 'Yes',
                 'personally_identifiable_information': 'Names, Social '
                                                        'Security numbers',
                 'sensitivity_of_data': 'High (Social Security numbers)',
                 'type_of_data_compromised': 'Personally Identifiable '
                                             'Information (PII)'},
 'date_publicly_disclosed': '2025-10-26',
 'description': 'LaBonne’s Markets, a Connecticut-based grocery chain owned by '
                'Hy LaBonne & Sons Inc., disclosed a data breach affecting '
                'consumers across multiple states after the PLAY ransomware '
                'group claimed responsibility and threatened to publish stolen '
                'data. The breach exposed names and Social Security numbers of '
                'affected individuals.',
 'impact': {'data_compromised': 'Names, Social Security numbers',
            'identity_theft_risk': 'High'},
 'motivation': 'Extortion, Data Theft',
 'ransomware': {'data_exfiltration': 'Yes', 'ransomware_strain': 'PLAY'},
 'references': [{'source': 'Regulatory filing, PLAY ransomware group Tor '
                           'network post'}],
 'regulatory_compliance': {'regulatory_notifications': 'Filed in May 2026'},
 'response': {'communication_strategy': 'Regulatory filing, notification '
                                        'letters to affected individuals',
              'third_party_assistance': 'Experian IdentityWorks'},
 'threat_actor': 'PLAY ransomware group',
 'title': 'LaBonne’s Markets Data Breach Exposes Personal Information of '
          'Dozens in New England',
 'type': 'Data Breach, Ransomware'}