Almeida Law Group is investigating a data breach at HUT American Group LLC. The breach occurred on April 8th–9th, 2026 and was discovered on July 29th, 2026. If you were affected, contact Almeida Law Group.
About HUT American Group LLC
HUT American Group LLC is the largest Pizza Hut franchisee in the United States, operating 941 Pizza Hut restaurants across 27 states. It is headquartered at 6200 Oak Tree Blvd, Independence, Ohio 44131, and is a wholly-owned subsidiary of Flynn Restaurant Group LP, the largest restaurant franchise operator in the world. Because this breach involved Social Security numbers, financial account information, medical information, and other highly sensitive personal data, affected individuals face serious risks of identity theft and financial fraud.
What Happened?
HUT American Group LLC was listed in a Texas Attorney General data security breach report filed on August 21st, 2026. According to the filing, a breach occurred on April 8th through April 9th, 2026 and was not discovered until July 29th, 2026 — a gap of approximately 112 days. HUT American Group notified 135,007 affected individuals by U.S. Mail. The compromised information included names combined with addresses, Social Security numbers, driver’s license numbers, government-issued ID numbers, financial account or card numbers, medical information, health insurance information, and dates of birth.
A Breachsense leak-site aggregator entry lists flynn.com — the domain of HUT American Group’s parent, Flynn Restaurant Group — with a threat actor identified as “PayoutsKING,” discovered on April 27th, 2026. This timing aligns with the April 8th–9th breach window reported to the Texas Attorney General. However, this remains an attacker-side claim from a leak-site aggregator and has not been confirmed by HUT American Group, Flynn Restaurant Group, or any regulatory authority. A sibling Flynn subsidiary, Apple American Group LLC (the operator of Applebee’s locations), disclosed a separate but nearly simultaneous data breach around August 18th, 2026, involving similarly broad categories of compromised data. The parallel disclosures suggest the incident may have originated at the Flynn Restaurant Group parent level, though neither the company nor any regulator has publicly confirmed that.
Key Facts at a Glance
- Company or Organization: HUT American Group LLC
- Industry: Food Service & Hospitality (Quick-Service / Fast-Food Restaurant Franchise)
- Location: 6200 Oak Tree Blvd, Independence, Ohio 44131
- Incident type: Unauthorized access to personal information; possible ransomware (unconfirmed attacker claim)
- Date of breach: April 8th, 2026 – April 9th, 2026
- Date breach discovered: July 29th, 2026
- Date of consumer notification: August 21st, 2026
- Total persons affected: 135,007
- Prior breach: A sibling Flynn Group subsidiary (Apple American Group LLC) disclosed a separate breach around August 18th, 2026, involving similar data types
- Litigation status: No class action litigation specific to this breach identified as of the research date
- Source: Texas Attorney General data security breach report; Breachsense; Apple American Group LLC breach disclosure
What Should You Do?
If you received a notice from HUT American Group LLC, review it carefully for any identity theft protection enrollment offer and sign up before the deadline. You should also place a fraud alert or credit freeze with all three major credit bureaus — Equifax, Experian, and TransUnion — to limit unauthorized access to your credit. Monitor your financial accounts and credit reports closely for unfamiliar activity, and obtain your free annual credit reports at AnnualCreditReport.com. Because medical and health insurance information was involved in this breach, review your Explanation of Benefits statements and request copies of your medical records to check for any services you did not receive. If you spot any suspicious activity, report it at IdentityTheft.gov for step-by-step guidance on recovering from identity theft.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
