Data Breach Notifications

Entity Information

  • Type of Organization: Financial Services
  • Entity Name: Bread Financial Payments, Inc.
  • Street Address: 3085 Loyalty Circle
  • City: Columbus
  • State, or Country if outside the US: Ohio
  • Zip Code: 43219

Submitted By

  • Name: Lisa Latier
  • Title: Sr Director, Managing Counsel, Legal Department
  • Firm name (if different than entity):
  • Telephone Number: 6147294068
  • Email Address:
  • Relationship to entity whose information was compromised: Employee - Sr Director, Managing Counsel, Legal Department

Breach Information

  • Total number of persons affected (including residents): 15,525
  • Total number of Maine residents affected: 180
  • If the number of Maine residents exceeds 1,000, have the consumer reporting agencies been notified:
  • Date(s) Breach Occured: 03/31/2023
  • Date Breach Discovered: 04/28/2023
  • Description of the Breach:
    • Other
    • If other, please specify: On or about April 28, 2023, Bread Financial became aware that a bad actor was redeeming customers’ credit card rewards points for cash using the customers’ personal information obtained from an unknown source and not believed to relate to our systems. The information in the possession of the bad actor that was required to do this was the customers’ credit card account numbers (a prior account number from their previous credit card issuer would suffice), the last four digits of their social security number, and zip code. These were customers who had not yet set up online accounts through the Account Center portal.
  • Information Acquired - Name or other personal identifier in combination with: Financial Account Number or Credit/Debit Card Number (in combination with security code, access code, password or PIN for the account)

Notification and Protection Services

  • Type of Notification: Electronic
  • Date(s) of consumer notification: 05/22/2023
  • Copy of notice to affected Maine residents: Cardholder Rewards Notification May 2023.pdf
  • Date of any previous (within 12 months) breach notifications:
  • Were identity theft protection services offered: Yes
  • If yes, please provide the duration, the provider of the service and a brief description of the service: 12 months of credit monitoring and identity protection services through Experian IdentityWorks