RansomwareLegalTeam.com

Got a notice from PEZ Candy, Inc.? Here’s what to do.

PEZ Candy, Inc. told the Massachusetts Attorney General that people’s information was exposed. If you got a letter, work through the steps below.

Your checklist

  1. 1

    Keep the letter

    Save the notice from PEZ Candy, Inc. and its envelope. The date you were told can matter for legal deadlines.

  2. 2

    Freeze your credit

    The filing does not list what was taken, so play it safe. A free freeze at Equifax, Experian and TransUnion stops new accounts being opened in your name.

  3. 3

    Change reused passwords

    Change any password you used with this company or reused elsewhere, and turn on two-factor sign-in.

  4. 4

    Get a free claim review

    Our legal team checks whether you can be paid for this breach. No fee unless you recover.

Step 4: free claim review

Tell us you got the PEZ Candy, Inc. notice. An attorney, not a call center, reads it and tells you plainly whether you have a claim.

  • Free, no obligation
  • No fee unless you recover
  • Reply within 24 hours

Got a Notification Letter? Find Out If You Qualify

Free review. No cost, no obligation.

Upload your breach letter (optional)

No attorney-client relationship is created by submitting this form. Attorney Advertising.

About the PEZ Candy, Inc. breach

Reported to
Massachusetts Attorney General
Date filed
May 6, 2025
People notified
Not stated
Cause in filing
Not stated

PEZ Candy, Inc. is a globally recognized manufacturer and distributor of iconic mechanical candy dispensers and confectionery products, operating extensive corporate, manufacturing, distribution, and e-commerce operations. To manage its expansive supply chain, direct-to-consumer sales platforms, international workforce, and corporate administration, the company routinely collects, processes, and stores vast quantities of sensitive information. This encompasses comprehensive employee records, payroll and tax details, proprietary corporate data, and personal identifiable information (PII) belonging to customers, vendors, and business partners. Because modern consumer brands rely heavily on digital storefronts, integrated enterprise resource planning systems, and robust human resources databases, PEZ Candy, Inc. holds a significant repository of confidential data that makes it an attractive target for malicious cyber actors seeking financial gain or corporate espionage. In 2025, PEZ Candy, Inc. officially reported a major security incident to the Massachusetts Attorney General, alerting consumers and regulatory authorities to a significant compromise of its network infrastructure. While specific technical forensics continue to emerge, data breaches affecting consumer goods corporations and retail-adjacent enterprises typically involve sophisticated ransomware attacks, unauthorized external intrusions into corporate databases, or vulnerabilities introduced through third-party vendor compromises. These incidents often target centralized servers housing human resources files, consumer database directories, and financial management systems, allowing unauthorized threat actors to dwell undetected within the corporate network and exfiltrate sensitive files before deploying encryption or demanding extortion. The data compromised during the PEZ Candy, Inc. breach exposes affected individuals to severe, long-term risks depending on the exact categories of information exposed, which typically include full names, Social Security numbers, dates of birth, financial account details, and confidential employment or consumer profile data. When foundational identifiers such as Social Security numbers and dates of birth are leaked, victims face an elevated, enduring threat of identity theft, fraudulent credit card applications, unauthorized loans, and tax fraud filed in their names. Furthermore, the exposure of consumer e-commerce data and employee credentials creates immediate vulnerabilities for targeted phishing campaigns, credential-stuffing attacks across unrelated platforms, and secondary financial account takeover. As an enterprise operating and maintaining commercial relationships within Massachusetts, PEZ Candy, Inc. is bound by stringent state and federal regulatory frameworks, including the Massachusetts Data Security Regulations (201 CMR 17.00) and broader consumer protection standards. These legal obligations mandate that commercial entities implement and maintain comprehensive, written information security programs, utilize robust encryption standards for personal data in transit and at rest, and deploy continuous monitoring systems to detect unauthorized access. The occurrence of this data breach strongly indicates potential failures or lapses in maintaining these mandated technical and administrative safeguards, raising significant questions regarding whether the company fulfilled its legal duty to adequately protect sensitive personal information. Receiving a data notification letter from PEZ Candy, Inc. serves as formal confirmation that your private data was compromised due to corporate security failures, and it establishes the legal standing necessary to participate in a class action lawsuit. Importantly, under modern legal precedent, affected individuals do not need to prove that they have already suffered direct financial loss or identity theft to seek legal redress; the mere exposure and increased risk of future harm resulting from inadequate data protection is sufficient to hold the company accountable. Our law firm is currently investigating potential claims against PEZ Candy, Inc. on a contingency fee basis, meaning there are never any out-of-pocket costs or upfront fees, and you pay nothing unless we successfully recover compensation on your behalf.

Full ransomware checklist

PEZ Candy, Inc. data breach questions

Is the PEZ Candy, Inc. data breach letter legit or a scam?
A notice from PEZ Candy, Inc. in the mail matches the breach PEZ Candy, Inc. reported to the Massachusetts Attorney General on May 6, 2025. Check that the company name and dates in your letter match that filing. A real notice of data security incident won't ask for your password, Social Security number or a payment — if it does, contact PEZ Candy, Inc. through a phone number or website you find yourself.
Did PEZ Candy, Inc. offer free credit monitoring?
Any free monitoring PEZ Candy, Inc. is offering will be described in the notice you received, along with an activation code and a sign-up deadline. Using the free service won't stop you from joining a lawsuit or settlement later.
Is there a PEZ Candy, Inc. data breach class action lawsuit?
Law firms often open an investigation after a breach notice like this one, and a class action lawsuit may follow. This page doesn't confirm that a lawsuit has been filed against PEZ Candy, Inc.. You usually don't have to join a class action to be included — if a settlement is reached, class members are notified and can file a claim.
What should I do after getting the PEZ Candy, Inc. data breach notice?
Keep the letter and the envelope, and note the date it arrived. Freeze your credit with Equifax, Experian and TransUnion, change any passwords the notice mentions, and sign up for any free credit monitoring the letter offers. Then check whether you may have a claim.
Do I need a PEZ Candy, Inc. data breach lawyer or attorney?
An attorney can read your notice and tell you whether a claim makes sense. A case review here is free, and data breach cases are usually handled on contingency, so there is no upfront cost.
Can I sue PEZ Candy, Inc. over the data breach?
It depends on what was exposed, the law in Massachusetts and your own state, and whether you've been harmed. Most people take part through a class action rather than suing alone. Keep your notification letter — it's the proof that connects you to the breach.
How much could a PEZ Candy, Inc. data breach settlement or claim be worth?
There is no set amount, and no PEZ Candy, Inc. settlement is confirmed here. In past data breach settlements, payments depended on what data was exposed and on documented losses — fraud, out-of-pocket costs and time spent dealing with the breach. Keep receipts and records; they're what damages claims are built on.

Other notices sent in Massachusetts

Attorney advertising. This page reflects a public regulator filing; it does not mean a lawsuit has been filed or that the company did anything unlawful. Submitting a review request does not create an attorney-client relationship.