Is the PEZ Candy, Inc. data breach letter legit or a scam?

A notice from PEZ Candy, Inc. in the mail matches the breach PEZ Candy, Inc. reported to the Massachusetts Attorney General on May 6, 2025. Check that the company name and dates in your letter match that filing. A real notice of data security incident won't ask for your password, Social Security number or a payment — if it does, contact PEZ Candy, Inc. through a phone number or website you find yourself.

Did PEZ Candy, Inc. offer free credit monitoring?

Any free monitoring PEZ Candy, Inc. is offering will be described in the notice you received, along with an activation code and a sign-up deadline. Using the free service won't stop you from joining a lawsuit or settlement later.

Is there a PEZ Candy, Inc. data breach class action lawsuit?

Law firms often open an investigation after a breach notice like this one, and a class action lawsuit may follow. This page doesn't confirm that a lawsuit has been filed against PEZ Candy, Inc.. You usually don't have to join a class action to be included — if a settlement is reached, class members are notified and can file a claim.

What should I do after getting the PEZ Candy, Inc. data breach notice?

Keep the letter and the envelope, and note the date it arrived. Freeze your credit with Equifax, Experian and TransUnion, change any passwords the notice mentions, and sign up for any free credit monitoring the letter offers. Then check whether you may have a claim.

Do I need a PEZ Candy, Inc. data breach lawyer or attorney?

An attorney can read your notice and tell you whether a claim makes sense. A case review here is free, and data breach cases are usually handled on contingency, so there is no upfront cost.

Can I sue PEZ Candy, Inc. over the data breach?

It depends on what was exposed, the law in Massachusetts and your own state, and whether you've been harmed. Most people take part through a class action rather than suing alone. Keep your notification letter — it's the proof that connects you to the breach.

How much could a PEZ Candy, Inc. data breach settlement or claim be worth?

There is no set amount, and no PEZ Candy, Inc. settlement is confirmed here. In past data breach settlements, payments depended on what data was exposed and on documented losses — fraud, out-of-pocket costs and time spent dealing with the breach. Keep receipts and records; they're what damages claims are built on.

The PEZ Candy, Inc. data breach: your legal rights

PEZ Candy, Inc. told the Massachusetts Attorney General that people’s personal information was exposed. If you got a notice, these are the rights you have.

Get a free case review

Your rights after this breach

To be told about the breach
Massachusetts law requires a company that loses residents' personal information to notify them. PEZ Candy, Inc. reported this breach to the Massachusetts Attorney General.
Massachusetts data breach notification law
To ask whether you can recover money
If PEZ Candy, Inc. did not take reasonable care of your information, you may have a claim for negligence or under Massachusetts law. An attorney can review it with you for free.
Massachusetts common law and consumer protection statutes

Rights every American has after a breach

Free case review

Tell us you got the PEZ Candy, Inc. notice. An attorney reviews it and tells you plainly whether you may have a claim.

Free, no obligation
No fee unless you recover
Reply within 24 hours

Got a Notification Letter? Find Out If You Qualify

Free review. No cost, no obligation.

Full name *

Email *

Phone *

State of residence *

Company that sent you a letter *

Yes, I would like help filing my claim.

Upload your breach letter (optional)

No attorney-client relationship is created by submitting this form. Attorney Advertising.

What PEZ Candy, Inc. reported

Reported to: Massachusetts Attorney General
Date filed: May 6, 2025
People notified: Not stated
Cause in filing: Not stated

PEZ Candy, Inc. is a globally recognized manufacturer and distributor of iconic mechanical candy dispensers and confectionery products, operating extensive corporate, manufacturing, distribution, and e-commerce operations. To manage its expansive supply chain, direct-to-consumer sales platforms, international workforce, and corporate administration, the company routinely collects, processes, and stores vast quantities of sensitive information. This encompasses comprehensive employee records, payroll and tax details, proprietary corporate data, and personal identifiable information (PII) belonging to customers, vendors, and business partners. Because modern consumer brands rely heavily on digital storefronts, integrated enterprise resource planning systems, and robust human resources databases, PEZ Candy, Inc. holds a significant repository of confidential data that makes it an attractive target for malicious cyber actors seeking financial gain or corporate espionage. In 2025, PEZ Candy, Inc. officially reported a major security incident to the Massachusetts Attorney General, alerting consumers and regulatory authorities to a significant compromise of its network infrastructure. While specific technical forensics continue to emerge, data breaches affecting consumer goods corporations and retail-adjacent enterprises typically involve sophisticated ransomware attacks, unauthorized external intrusions into corporate databases, or vulnerabilities introduced through third-party vendor compromises. These incidents often target centralized servers housing human resources files, consumer database directories, and financial management systems, allowing unauthorized threat actors to dwell undetected within the corporate network and exfiltrate sensitive files before deploying encryption or demanding extortion. The data compromised during the PEZ Candy, Inc. breach exposes affected individuals to severe, long-term risks depending on the exact categories of information exposed, which typically include full names, Social Security numbers, dates of birth, financial account details, and confidential employment or consumer profile data. When foundational identifiers such as Social Security numbers and dates of birth are leaked, victims face an elevated, enduring threat of identity theft, fraudulent credit card applications, unauthorized loans, and tax fraud filed in their names. Furthermore, the exposure of consumer e-commerce data and employee credentials creates immediate vulnerabilities for targeted phishing campaigns, credential-stuffing attacks across unrelated platforms, and secondary financial account takeover. As an enterprise operating and maintaining commercial relationships within Massachusetts, PEZ Candy, Inc. is bound by stringent state and federal regulatory frameworks, including the Massachusetts Data Security Regulations (201 CMR 17.00) and broader consumer protection standards. These legal obligations mandate that commercial entities implement and maintain comprehensive, written information security programs, utilize robust encryption standards for personal data in transit and at rest, and deploy continuous monitoring systems to detect unauthorized access. The occurrence of this data breach strongly indicates potential failures or lapses in maintaining these mandated technical and administrative safeguards, raising significant questions regarding whether the company fulfilled its legal duty to adequately protect sensitive personal information. Receiving a data notification letter from PEZ Candy, Inc. serves as formal confirmation that your private data was compromised due to corporate security failures, and it establishes the legal standing necessary to participate in a class action lawsuit. Importantly, under modern legal precedent, affected individuals do not need to prove that they have already suffered direct financial loss or identity theft to seek legal redress; the mere exposure and increased risk of future harm resulting from inadequate data protection is sufficient to hold the company accountable. Our law firm is currently investigating potential claims against PEZ Candy, Inc. on a contingency fee basis, meaning there are never any out-of-pocket costs or upfront fees, and you pay nothing unless we successfully recover compensation on your behalf.

PEZ Candy, Inc. data breach questions

Is the PEZ Candy, Inc. data breach letter legit or a scam?: A notice from PEZ Candy, Inc. in the mail matches the breach PEZ Candy, Inc. reported to the Massachusetts Attorney General on May 6, 2025. Check that the company name and dates in your letter match that filing. A real notice of data security incident won't ask for your password, Social Security number or a payment — if it does, contact PEZ Candy, Inc. through a phone number or website you find yourself.
Did PEZ Candy, Inc. offer free credit monitoring?: Any free monitoring PEZ Candy, Inc. is offering will be described in the notice you received, along with an activation code and a sign-up deadline. Using the free service won't stop you from joining a lawsuit or settlement later.
Is there a PEZ Candy, Inc. data breach class action lawsuit?: Law firms often open an investigation after a breach notice like this one, and a class action lawsuit may follow. This page doesn't confirm that a lawsuit has been filed against PEZ Candy, Inc.. You usually don't have to join a class action to be included — if a settlement is reached, class members are notified and can file a claim.
What should I do after getting the PEZ Candy, Inc. data breach notice?: Keep the letter and the envelope, and note the date it arrived. Freeze your credit with Equifax, Experian and TransUnion, change any passwords the notice mentions, and sign up for any free credit monitoring the letter offers. Then check whether you may have a claim.
Do I need a PEZ Candy, Inc. data breach lawyer or attorney?: An attorney can read your notice and tell you whether a claim makes sense. A case review here is free, and data breach cases are usually handled on contingency, so there is no upfront cost.
Can I sue PEZ Candy, Inc. over the data breach?: It depends on what was exposed, the law in Massachusetts and your own state, and whether you've been harmed. Most people take part through a class action rather than suing alone. Keep your notification letter — it's the proof that connects you to the breach.
How much could a PEZ Candy, Inc. data breach settlement or claim be worth?: There is no set amount, and no PEZ Candy, Inc. settlement is confirmed here. In past data breach settlements, payments depended on what data was exposed and on documented losses — fraud, out-of-pocket costs and time spent dealing with the breach. Keep receipts and records; they're what damages claims are built on.

Other breaches reported in Massachusetts

Attorney advertising. General information, not legal advice for your situation. This page reflects a public regulator filing; it does not mean a lawsuit has been filed or that the company did anything unlawful. Submitting a review request does not create an attorney-client relationship.