Sapp Bros. Suffers Major Data Breach Impacting Over 16,000 Individuals Sapp Bros., Inc., a prominent travel center operator and petroleum distributor based in Omaha, Nebraska, confirmed a significant data breach after an unauthorized actor accessed its network on August 25, 2025. The hacking group Worldleaks claimed responsibility, leaking the stolen data on the dark web via the Tor network on September 23, 2025. The breach exposed sensitive personally identifiable information (PII), including full names, addresses, Social Security numbers, demographic details, and in some cases, driver’s license numbers. A forensic review completed on November 10, 2025, confirmed the compromise of this data, affecting 16,292 individuals nationwide, with 1,741 Iowa residents impacted, as disclosed to the Iowa Attorney General on December 11, 2025. The attack appears to have been targeted and sophisticated, exploiting network vulnerabilities before detection. Given the nature of the exposed data—particularly Social Security and driver’s license numbers—the breach poses a high risk of identity theft and fraud. In response, Sapp Bros. secured its systems and offered free credit monitoring and identity protection services through IDX for 12 months to affected individuals, with enrollment available until March 10, 2026. The full scope of the breach, including potential customer impact, remains under review.