Almeida Law Group is investigating a data breach at See’s Candies, Inc. The breach occurred on April 11th–13th, 2026 and was discovered on April 12th, 2026. If you were affected, contact Almeida Law Group.
About See’s Candies, Inc.
See’s Candies (legally See’s Candy Shops, Inc.) is an American manufacturer and distributor of candy, particularly chocolates, founded in 1921 and headquartered in South San Francisco, California. It is a wholly owned subsidiary of Berkshire Hathaway, which acquired the company in 1972. The company operates over 230 retail shops across the United States and employs approximately 1,500 year-round workers and more than 6,000 seasonal workers. Because the breach exposed Social Security numbers, driver’s license numbers, government-issued ID numbers, medical information, and dates of birth alongside names and addresses, affected individuals face meaningful risks of identity theft and fraud.
What Happened?
See’s Candies, Inc. was listed in a Texas Attorney General data security breach report filed on September 3rd, 2026. According to that filing and the company’s own disclosure, See’s Candies suffered a ransomware attack in which an unauthorized user accessed portions of its computer network, encrypted files on a subset of servers, and acquired certain files before encrypting them. The incident lasted from April 11th, 2026 through April 13th, 2026 and was discovered on April 12th, 2026. A total of 23,737 individuals were affected. The data involved included names, addresses, Social Security numbers, driver’s license numbers, government-issued ID numbers (such as passports or state ID cards), medical information, and dates of birth. Consumer notifications were sent by U.S. Mail. See’s Candies is offering 12 months of Experian IdentityWorks identity theft protection to affected individuals.
The ransomware group Qilin claimed responsibility for the attack on a Tor-based dark web site on April 30th, 2026, stating that it had obtained See’s Candies data. This is an attacker-side claim; See’s Candies’ own disclosure confirms a ransomware attack with file encryption and data exfiltration but does not publicly name Qilin as the responsible party. A separate unverified listing at databreach.com references 113,000 rows associated with See’s Candies, a figure that exceeds the 23,737 total reported in the Texas AG filing; this discrepancy has not been resolved. The breach was reported to the California Attorney General on August 13th, 2026, approximately four months after discovery, and to the Texas Attorney General on September 3rd, 2026. Multiple law firms, including Shamis & Gentile P.A. and Ahdoot & Wolfson, have announced class action investigations; no lawsuit had been filed as of September 2026.
Key Facts at a Glance
- Company or Organization: See’s Candies, Inc.
- Industry: Retail confectionery / candy manufacturing
- Location: South San Francisco, California
- Incident type: Ransomware attack with data exfiltration
- Date of breach: April 11th, 2026 – April 13th, 2026
- Date breach discovered: April 12th, 2026
- Date of consumer notification: September 3rd, 2026 (Texas AG report date; California AG notice filed August 13th, 2026)
- Total persons affected: 23,737
- Identity theft protection offered: 12 months of Experian IdentityWorks
- Litigation status: Class action investigations announced by multiple law firms; no filed lawsuit found as of September 2026
- Source: Texas Attorney General – Data Security Breach Report; ClaimDepot – See’s Candies Data Breach Overview; DeXpose – Qilin Strikes See’s Candies; Ahdoot & Wolfson – See’s Candies Investigation
What Should You Do?
If you received a notice from See’s Candies, enroll in the 12 months of free Experian IdentityWorks identity theft protection offered by the company and note any enrollment deadline included in your notice. Because Social Security numbers, driver’s license numbers, and other government-issued ID numbers were exposed, consider placing a free fraud alert or credit freeze with each of the three major credit bureaus — Equifax, Experian, and TransUnion. Review your credit reports for unfamiliar accounts or activity at AnnualCreditReport.com, which provides free reports. Because medical information was also listed among the exposed data types, review any Explanation of Benefits statements from your health insurer and check your medical records for services you did not receive. If you spot signs of fraudulent activity, report it at IdentityTheft.gov, where the Federal Trade Commission can help you create a personalized recovery plan.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
