Tootsie Roll Industries, Inc. data breach

What we know

Tootsie Roll Industries, Inc. is a major, publicly traded confectionary manufacturer known worldwide for producing iconic brands like Tootsie Rolls, Charms Blow Pops, and Junior Mints. Operating massive manufacturing plants, extensive distribution networks, and corporate offices, the company collects and maintains a vast volume of sensitive data. Beyond consumer interactions, the enterprise handles comprehensive personnel records for thousands of current and former employees, confidential payroll files, complex vendor and supply chain contracts, intellectual property, and proprietary commercial information. Because of its large corporate footprint, Tootsie Roll Industries holds a significant repository of personally identifiable information belonging to its workforce, making its digital infrastructure an attractive target for malicious actors seeking high-value corporate and individual data. In 2025, Tootsie Roll Industries reported a major cybersecurity incident to the Massachusetts Attorney General, signaling a critical failure in its digital defenses. While the precise mechanics of the breach are still under investigation, incidents affecting large-scale manufacturing and consumer goods corporations typically involve sophisticated cyberattacks such as ransomware deployments, unauthorized network infiltration, or third-party vendor compromises. Modern threat actors frequently exploit vulnerabilities in enterprise resource planning software, email servers, or employee credentials to bypass perimeter security. Once inside, these unauthorized parties can extract confidential files from corporate servers, deploy encryption malware to disrupt business operations, and exfiltrate sensitive databases containing both corporate secrets and employee privacy records. The data compromised in this security incident likely includes a dangerous combination of sensitive personal information, such as full names, Social Security numbers, dates of birth, home addresses, banking details for direct deposit, and wage or tax documents. The exposure of this information creates severe, long-term risks for affected individuals. Social Security numbers and dates of birth are the foundational building blocks for identity theft, enabling cybercriminals to open fraudulent credit lines, secure unauthorized loans, or intercept government tax refunds. Furthermore, compromised banking and payroll data exposes victims to direct financial account takeover and fraudulent wire transfers, leaving them vulnerable to significant monetary losses and enduring stress. As an enterprise operating and employing individuals in Massachusetts, Tootsie Roll Industries had strict legal obligations under state and federal law to safeguard sensitive personal data. Under the Massachusetts Data Privacy Act and Massachusetts general data security regulations (201 CMR 17.00), companies handling the personal information of state residents are required to maintain comprehensive, written information security programs. These mandates obligate businesses to encrypt sensitive data at rest and in transit, implement robust access controls, regularly monitor network activity, and conduct rigorous vendor risk assessments. The occurrence of a data breach of this magnitude strongly suggests that Tootsie Roll Industries may have failed to adhere to these foundational security standards, leaving its digital environment vulnerable to avoidable intrusions. Receiving a data breach notification letter from Tootsie Roll Industries is a formal acknowledgment that your private information was compromised due to corporate negligence. Legally, the receipt of this letter establishes the standing required to participate in a class action lawsuit aimed at holding the company accountable for its security lapses. Importantly, affected individuals do not need to prove that they have already suffered actual financial fraud or out-of-pocket losses to seek legal relief; the increased, imminent risk of identity theft and the loss of privacy are recognized legal harms. Our law firm is currently investigating this breach on a contingency fee basis, meaning there are never any out-of-pocket costs or attorney fees unless we successfully recover compensation on your behalf.

See every breach reported in Massachusetts or read what to do after a ransomware attack.