See’s Candies, Inc., the well-known California confectionery company, recently notified California’s Attorney General that unauthorized access to its computer network resulted in a data security incident affecting individuals whose personal information was stored on impacted systems. Companies that collect and retain personal information, whether from customers or employees, have a responsibility to safeguard that data against unauthorized access and to promptly notify affected individuals when a breach occurs.
See’s Candies’s Data Breach Investigation
See’s Candies, Inc. reported to the California Attorney General that it discovered unauthorized access to portions of its computer network in April 2026. According to the notice filed with California regulators, the company was alerted that an unauthorized user had accessed certain network systems and encrypted files on a subset of its servers. See’s Candies states that it immediately launched an investigation with the assistance of outside cybersecurity specialists and notified law enforcement after discovering the intrusion.
The company’s investigation determined that the unauthorized access spanned a period in mid-April 2026. Initially, See’s Candies reported that it was unable to determine whether any files had been removed from its systems during the intrusion. As the forensic review continued, however, the company learned that the unauthorized actor had copied certain files before encrypting them, and that at least some of those files were later made available on the dark web. See’s Candies has stated that determining the full scope of the incident, restoring the integrity of its systems, and identifying every individual whose personal information may have been involved required an extended forensic review given the complexity of the intrusion.
Public reporting has also connected a ransomware group to a cyberattack claim against See’s Candies around the same general timeframe, though the notice filed with California’s Attorney General does not itself attribute the incident to a specific named group. See’s Candies has not publicly disclosed the exact number of individuals affected by the breach.
Incidents involving ransomware and network intrusions have become increasingly common across the retail and consumer products sector in recent years, as companies of all sizes store growing volumes of customer and employee data across interconnected systems. Retailers are frequently targeted specifically because payment information, order histories, and account credentials collected through e-commerce platforms and loyalty programs can be resold or leveraged for further fraud. When a threat actor both encrypts and exfiltrates data during the same intrusion, commonly known as a double-extortion attack, the risk to affected individuals extends beyond any operational disruption the victim company experiences, since data copied before encryption can be posted publicly or sold on dark web marketplaces regardless of whether a ransom is ultimately paid.
The type of personal information exposed in an incident like this can significantly affect the kind of fraud risk individuals face. Even when a company has not yet disclosed the complete list of data categories involved, a name combined with any other piece of identifying information is often enough to enable targeted phishing attempts, account takeover attempts, or identity theft schemes. Individuals notified of a breach are frequently targeted afterward by follow-up phishing emails or phone calls that reference the breach itself in an attempt to appear legitimate and extract additional sensitive information.
Notification timelines for data breaches are generally governed by state law, and companies are often required to complete a reasonable investigation before notifying affected individuals so that the notice reflects an accurate understanding of what occurred. See’s Candies filed its notification with the California Attorney General’s office in mid-August 2026, several months after the unauthorized access was first discovered, which the company has attributed to the time required to complete its forensic investigation into which files were affected. Multi-month gaps between the discovery of a network intrusion and formal notification are not unusual for breaches involving both encryption and data exfiltration, since identifying every impacted file and cross-referencing it against affected individuals is typically a lengthy process.
Companies affected by a ransomware-style intrusion often face a difficult choice between negotiating with the responsible group and refusing to engage, and that decision can influence whether stolen files are ultimately published. Regardless of how a company responds to threat actor demands, once files have been copied off a network, affected individuals generally cannot rely on any assurance that the data has been fully deleted or contained, which is part of why companies are required to notify individuals and offer monitoring services even when there is no confirmed evidence of misuse yet.
When Did This Breach Occur?
According to the notice See’s Candies filed with the California Attorney General, the unauthorized access to its network occurred between April 11, 2026 and April 13, 2026. The company states it was notified of the intrusion on April 12, 2026, and immediately began an investigation with outside cybersecurity experts. See’s Candies has said that determining whether any files were removed from its systems, and later confirming that some files were made available on the dark web, required an extended forensic review. The company filed its formal notification with California regulators in mid-August 2026, several months after first discovering the intrusion.
What Information Was Breached?
See’s Candies has not yet publicly specified the complete categories of personal information involved in this incident. The notice filed with the California Attorney General states that impacted files contain each affected individual’s name in combination with certain other personal information, without listing every specific data category involved. See’s Candies has not disclosed the total number of individuals affected. The company has indicated that its review of the impacted files is ongoing, and it is possible that additional details about the specific information involved may be released as the investigation continues.
What You Can Do
See’s Candies is offering affected individuals twelve months of complimentary identity theft protection through Experian IdentityWorks, including credit monitoring and identity restoration support. If you received a notice from See’s Candies or believe you may have been affected by this breach, consider the following steps:
- Enroll in any identity monitoring service offered by See’s Candies before the stated deadline
- Review your financial account statements and credit reports regularly for unfamiliar activity
- Consider placing a fraud alert or a security freeze on your credit file with Equifax, Experian, and TransUnion
- Be cautious of unsolicited calls, texts, or emails referencing this breach, since scammers sometimes use real incidents to appear credible
- Report any suspected identity theft or fraud to your local police department and the Federal Trade Commission
File a Data Breach Lawsuit Against See’s Candies
If your personal information was exposed as a result of the See’s Candies data breach, you may have legal options available to you. Companies that collect personal information have a duty to implement reasonable safeguards to protect that data, and individuals affected by a breach can face real and lasting consequences, from the time spent monitoring accounts to the ongoing risk of identity theft or fraud.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
