A Salesforce misconfiguration at 7-Eleven, detected around 8 April 2026, produced a claim of more than 600,000 records against approximately 185,300 subsequently verified. Franchisee systems were described as affected.
The gap between claim and verification is the same pattern filed at ADT in 26-0425. The franchise dimension is the new element.
Who Owns The Notification?
A franchise network is legally a set of independent businesses operating under a shared brand and, frequently, shared systems provided by the franchisor.
When data held in franchisor-provided systems is exposed, the notification obligation may sit with the individual franchisee whose customers they are — businesses that typically have no privacy function, no legal department and no capacity to run a notification programme.
The Customer Sees One Brand
None of this structure is visible from outside. A customer transacted with a shop displaying a national brand and reasonably attributes the incident to that brand.
It is the same structural gap as the white-label platform filed in 26-0723: the entity the customer believes they dealt with, the entity holding the data, and the entity owing the notification can be three different parties.
Compiled from public reporting, listed below. Where claimed and verified counts differ we give both. The specific misconfiguration has not been detailed publicly. Corrections: corrections@forensicpost.com.
- List of recent data breaches in 2026Bright Defense