PEZ Candy, Inc. data breach

What we know

PEZ Candy, Inc. is a globally recognized manufacturer and distributor of iconic mechanical candy dispensers and confectionery products, operating extensive corporate, manufacturing, distribution, and e-commerce operations. To manage its expansive supply chain, direct-to-consumer sales platforms, international workforce, and corporate administration, the company routinely collects, processes, and stores vast quantities of sensitive information. This encompasses comprehensive employee records, payroll and tax details, proprietary corporate data, and personal identifiable information (PII) belonging to customers, vendors, and business partners. Because modern consumer brands rely heavily on digital storefronts, integrated enterprise resource planning systems, and robust human resources databases, PEZ Candy, Inc. holds a significant repository of confidential data that makes it an attractive target for malicious cyber actors seeking financial gain or corporate espionage. In 2025, PEZ Candy, Inc. officially reported a major security incident to the Massachusetts Attorney General, alerting consumers and regulatory authorities to a significant compromise of its network infrastructure. While specific technical forensics continue to emerge, data breaches affecting consumer goods corporations and retail-adjacent enterprises typically involve sophisticated ransomware attacks, unauthorized external intrusions into corporate databases, or vulnerabilities introduced through third-party vendor compromises. These incidents often target centralized servers housing human resources files, consumer database directories, and financial management systems, allowing unauthorized threat actors to dwell undetected within the corporate network and exfiltrate sensitive files before deploying encryption or demanding extortion. The data compromised during the PEZ Candy, Inc. breach exposes affected individuals to severe, long-term risks depending on the exact categories of information exposed, which typically include full names, Social Security numbers, dates of birth, financial account details, and confidential employment or consumer profile data. When foundational identifiers such as Social Security numbers and dates of birth are leaked, victims face an elevated, enduring threat of identity theft, fraudulent credit card applications, unauthorized loans, and tax fraud filed in their names. Furthermore, the exposure of consumer e-commerce data and employee credentials creates immediate vulnerabilities for targeted phishing campaigns, credential-stuffing attacks across unrelated platforms, and secondary financial account takeover. As an enterprise operating and maintaining commercial relationships within Massachusetts, PEZ Candy, Inc. is bound by stringent state and federal regulatory frameworks, including the Massachusetts Data Security Regulations (201 CMR 17.00) and broader consumer protection standards. These legal obligations mandate that commercial entities implement and maintain comprehensive, written information security programs, utilize robust encryption standards for personal data in transit and at rest, and deploy continuous monitoring systems to detect unauthorized access. The occurrence of this data breach strongly indicates potential failures or lapses in maintaining these mandated technical and administrative safeguards, raising significant questions regarding whether the company fulfilled its legal duty to adequately protect sensitive personal information. Receiving a data notification letter from PEZ Candy, Inc. serves as formal confirmation that your private data was compromised due to corporate security failures, and it establishes the legal standing necessary to participate in a class action lawsuit. Importantly, under modern legal precedent, affected individuals do not need to prove that they have already suffered direct financial loss or identity theft to seek legal redress; the mere exposure and increased risk of future harm resulting from inadequate data protection is sufficient to hold the company accountable. Our law firm is currently investigating potential claims against PEZ Candy, Inc. on a contingency fee basis, meaning there are never any out-of-pocket costs or upfront fees, and you pay nothing unless we successfully recover compensation on your behalf.

See every breach reported in Massachusetts or read what to do after a ransomware attack.