California Pizza Kitchen cpk.com

California Pizza Kitchen data breach: what happened and what to do

California Pizza Kitchen told current and former employees in November 2021 that files taken in a September 15, 2021 system breach included their names and Social Security numbers. Maine's attorney general listed 103,767 people affected.

View all 13,177 breaches
Breach date
15 Sept 2021
Made public
15 Nov 2021
Affected
103,767
Data exposed
Names, Social security numbers
Last updated

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

California Pizza Kitchen (CPK) first noticed a disruption to some of its systems on or around September 15, 2021. Its notice says files were accessed without authorization. On October 13, 2021 it confirmed that the files held employee data, and it mailed notices on November 15, 2021.

This breach is about people who worked for CPK, not people who ate there. The notice filed with the California attorney general says the information was names and Social Security numbers. According to the Maine attorney general's breach record, as reported by TechCrunch, 103,767 current and former employees were notified. CPK's own notice doesn't give a total, and the California and Washington listings count only residents of those states, so 103,767 is the figure to use.

A Social Security number is the part that matters. Unlike a password, you can't change it, and criminals use it with a name to open credit accounts, file fake tax returns or claim benefits in someone else's name. Names plus SSNs also make phishing more convincing: a message that quotes your real details looks like it comes from a lender or the IRS.

CPK offered affected people identity theft protection with credit monitoring. Press reports name different providers, so check the provider and sign-up deadline in your own letter. The company has said the notification wasn't delayed by law enforcement, and TechCrunch questioned why state regulators were told about two months after the breach.

If you worked at CPK and got a letter, treat it as real, but sign up through the contact details in the letter or on the company's own site, not through a link in an email or text.

Sources checked: oag.ca.gov, techcrunch.com, threatpost.com

Last verified against the official page:

How we research this Report an error

What to do if you were in it

  1. 1

    Freeze your credit at all three bureaus

    A security freeze is free and stops new creditors from opening accounts in your name. Do it with Equifax, Experian and TransUnion. The FTC explains how at consumer.ftc.gov.

  2. 2

    Accept the free credit monitoring in your letter

    If CPK mailed you a notice, use the offer. Enroll through the instructions in the letter, not through an unsolicited email or text.

  3. 3

    Check your credit reports and statements

    Get your free reports at annualcreditreport.com and look for accounts or loans you don't recognize. Report identity theft at IdentityTheft.gov, the FTC's reporting site.

  4. 4

    Be careful with messages that know your details

    Expect phishing and smishing that mention your job, your name or this breach. Don't click links or give out your SSN in reply to a call, email or text you didn't start.

  5. 5

    Check whether your email or phone is in this and other breaches

    Serus's free scan checks breach databases for your email and phone and tells you what to do next. It can't remove data from a breach, but it alerts you when your details show up.

Official filings

Timeline

  1. The breach happened

  2. The company made it public

  3. Reported to the Washington Attorney General

Frequently asked

Was I affected by the California Pizza Kitchen data breach?

Only current and former employees were notified. If you worked at CPK and got a letter in November 2021, your name and Social Security number were in the files. Customers weren't named in the notice.

What was exposed?

Names and Social Security numbers, according to the notice filed with the California attorney general.

How many people were affected?

103,767 current and former employees, per Maine's attorney general breach record as reported by TechCrunch.

Should I change my password?

The notice doesn't say passwords were taken, so a password change isn't the priority. A credit freeze is.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Serus

Check if you're exposed in a breach with Serus

Find your leaks. Get alerted to new ones.

Run a free scan

Related guides

All guides
How to opt out of prescreened credit card offers (OptOutPrescreen) optoutprescreen.com Remove yourself from Equifax equifax.com Remove yourself from Experian experian.com Remove yourself from TransUnion transunion.com

Related articles

All articles

How to Get My Information Off the Dark Web

What is the dark web? Definition and how it works

What Happens If Your Email Is on the Dark Web – And What to Do Next

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.