Almeida Law Group is investigating a data breach at Petco Animal Supplies Stores, Inc. If you were affected, contact Almeida Law Group.
About Petco Animal Supplies Stores, Inc.
Petco Health and Wellness Company, Inc., doing business as Petco, is a major American pet retailer founded in 1965 and headquartered in San Diego, California. The company sells pet food, products, services, and live animals across approximately 1,500 retail locations in the United States, Mexico, and Puerto Rico, serving more than 24 million customers. It is publicly traded on NASDAQ under the ticker WOOF. Because Petco collects personal and financial information from its large customer base, breaches affecting its systems can expose sensitive identifying data to potential misuse.
What Happened?
Petco Animal Supplies Stores, Inc. was listed in a Vermont Attorney General breach report summary dated September 10th, 2026. The filing identifies the incident type as an unauthorized exposure of data and categorizes the breached information as Government ID Numbers. According to supplemental reporting by TechCrunch, Fox News, and state regulatory filings, the exposed data also included names, Social Security numbers, driver’s license numbers, financial account numbers, credit or debit card numbers, and dates of birth. The incident was attributed to a misconfigured software application setting that inadvertently made files accessible online — not a hacking or ransomware attack. Petco reportedly discovered the issue during a routine security review in July 2025 and began notifying affected individuals in late 2025. The Vermont AG filing was one of several state-level notifications; Class Action U notes the incident was also reported to the Texas Attorney General on September 9th, 2026. Petco has not publicly disclosed the total number of individuals affected. The company is offering complimentary credit and identity monitoring through Epiq Privacy Solutions ID.
Petco has a notable history of prior security incidents. In 2020, a class action was filed over a breach affecting more than 30,000 users of PupBox, a Petco subsidiary, exposing payment card details and personal information. A separate incident reported to the Maine Attorney General involved a checkout scraper plugin that forwarded customer payment data to a third-party server. In December 2025, TechCrunch reported that Petco’s Vetco Clinics website had also exposed customer data. Regarding the current misconfiguration incident, at least one class action lawsuit has been filed — plaintiff Matthew Mack alleged Petco failed to adequately safeguard consumers’ personal information, and multiple law firms including Lynch Carpenter and Emery Reddy have announced investigations. Class Action U lists Petco as a current mass arbitration target.
Key Facts at a Glance
- Company or Organization: Petco Animal Supplies Stores, Inc.
- Industry: Pet retail / Specialty retail
- Location: San Diego, California
- Incident type: Misconfigured software application setting exposing files online
- Date breach discovered: July 2025 (per lawsuit filings)
- Date of consumer notification: December 2025 (initial notifications); September 10th, 2026 (Vermont AG filing)
- Identity theft protection offered: Complimentary credit and identity monitoring through Epiq Privacy Solutions ID
- Prior breach: Yes — 2020 PupBox breach (30,000+ users); checkout scraper incident (Maine AG); Vetco Clinics exposure (December 2025)
- Litigation status: Class action filed by plaintiff Matthew Mack; investigations announced by Lynch Carpenter and Emery Reddy; listed as mass arbitration target by Class Action U
- Source: Vermont Attorney General breach report summary; TechCrunch; Fox News; Top Class Actions; Class Action U; AllAboutLawyer
What Should You Do?
If you believe your information was involved in this breach, enroll in the complimentary credit and identity monitoring offered by Petco through Epiq Privacy Solutions ID as soon as possible and note any enrollment deadline communicated in your notification letter. You should also place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent unauthorized accounts from being opened in your name. Monitor your existing financial accounts closely for unfamiliar charges and review your credit reports for free at AnnualCreditReport.com. Because Social Security numbers and driver’s license numbers were among the data types reported exposed, you may want to contact the Social Security Administration or your state’s DMV if you notice signs of identity misuse. If you believe you are a victim of identity theft, report it at IdentityTheft.gov for a personalized recovery plan.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
