Sapp Bros. Suffers Major Data Breach Impacting Over 16,000 Individuals
Sapp Bros., Inc., a prominent travel center operator and petroleum distributor based in Omaha, Nebraska, confirmed a significant data breach after an unauthorized actor accessed its network on August 25, 2025. The hacking group Worldleaks claimed responsibility, leaking the stolen data on the dark web via the Tor network on September 23, 2025.
The breach exposed sensitive personally identifiable information (PII), including full names, addresses, Social Security numbers, demographic details, and in some cases, driver’s license numbers. A forensic review completed on November 10, 2025, confirmed the compromise of this data, affecting 16,292 individuals nationwide, with 1,741 Iowa residents impacted, as disclosed to the Iowa Attorney General on December 11, 2025.
The attack appears to have been targeted and sophisticated, exploiting network vulnerabilities before detection. Given the nature of the exposed data—particularly Social Security and driver’s license numbers—the breach poses a high risk of identity theft and fraud.
In response, Sapp Bros. secured its systems and offered free credit monitoring and identity protection services through IDX for 12 months to affected individuals, with enrollment available until March 10, 2026. The full scope of the breach, including potential customer impact, remains under review.
Source: https://www.claimdepot.com/data-breach/sapp-bros-2025
Sapp Bros., Inc. cybersecurity rating report: https://www.rankiteo.com/company/sapp-bros.-inc.
"id": "SAP1766514002",
"linkid": "sapp-bros.-inc.",
"type": "Breach",
"date": "8/2025",
"severity": "85",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"{'affected_entities': [{'customers_affected': '16,292 individuals nationwide, '
'including 1,741 Iowa residents',
'industry': 'Travel Centers, Petroleum Distribution',
'location': 'Omaha, Nebraska, USA',
'name': 'Sapp Bros., Inc.',
'type': 'Company'}],
'attack_vector': 'Hacking',
'customer_advisories': 'Affected individuals notified and advised to enroll '
'in free credit monitoring and identity protection '
'services until March 10, 2026',
'data_breach': {'data_exfiltration': 'Yes (leaked on the dark web by '
'Worldleaks)',
'number_of_records_exposed': '16,292',
'personally_identifiable_information': ['Full names',
'Addresses',
'Social Security '
'numbers',
'Driver’s license '
'numbers',
'Demographic '
'information'],
'sensitivity_of_data': 'High (Social Security numbers, '
'driver’s license numbers)',
'type_of_data_compromised': 'Personally identifiable '
'information (PII)'},
'date_detected': '2025-08-25',
'date_publicly_disclosed': '2025-09-23',
'description': 'Sapp Bros., Inc., a well-known operator of travel centers and '
'a major petroleum distributor, experienced a significant data '
'breach impacting employees and possibly customers. An '
'unauthorized actor gained access to information stored on the '
'Sapp Bros. network, with personally identifiable information '
'(PII) exposed, including full names, addresses, Social '
'Security numbers, and driver’s license numbers.',
'impact': {'brand_reputation_impact': 'Potential brand reputation damage due '
'to exposure of sensitive employee and '
'customer data',
'data_compromised': 'Personally identifiable information (PII), '
'including full names, addresses, Social '
'Security numbers, and driver’s license '
'numbers',
'identity_theft_risk': 'High risk of identity theft due to '
'exposure of Social Security numbers and '
'driver’s license numbers',
'systems_affected': 'Sapp Bros. network'},
'investigation_status': 'Ongoing (full extent of affected parties still being '
'clarified)',
'post_incident_analysis': {'root_causes': 'Vulnerabilities in the Sapp Bros. '
'network exploited by the threat '
'actor'},
'ransomware': {'data_exfiltration': 'Yes'},
'references': [{'date_accessed': '2025-09-23',
'source': 'Tor network posting by Worldleaks'},
{'date_accessed': '2025-12-11',
'source': 'Disclosure to the Iowa Attorney General'}],
'regulatory_compliance': {'regulatory_notifications': 'Disclosure to the Iowa '
'Attorney General on '
'Dec. 11, 2025'},
'response': {'communication_strategy': 'Notification to affected individuals '
'and disclosure to the Iowa Attorney '
'General',
'remediation_measures': 'Secured systems, arranged free credit '
'monitoring and identity protection '
'services for affected individuals',
'third_party_assistance': 'IDX (credit monitoring and identity '
'protection services)'},
'threat_actor': 'Worldleaks',
'title': 'Sapp Bros., Inc. Data Breach by Worldleaks',
'type': 'Data Breach'}