See's Candies
Disclosed Aug 13, 20266 weeks ago23,737 affectedConfirmed
See's Candies ransomware attack leaks files with personal data on dark web
See's Candies said an unauthorized user accessed its network from April 11 to 13, 2026 and encrypted files after taking some of them, and that some stolen files were published on the dark web. It notified affected individuals in September.
What is known
| People affected | 23,737 (as reported by the organization) |
|---|---|
| Disclosed | Aug 13, 2026 |
| Discovered | Apr 12, 2026 |
| Happened | Apr 11, 2026 |
| Attack | Ransomware |
| Data exposed | Names, Other, Social Security numbers, Government IDs, Health, Dates of birth, Addresses |
| Sector | Retail · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: See's Candiesoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: See's Candiesatg.wa.gov · Official notice | Official notice |
| California AG breach report: See's Candiesoag.ca.gov · Regulator | Regulator |
| See's Candies sample noticeoag.ca.gov · Regulator | Regulator |
| Texas Attorney General data security breach report BR-0005305: See's Candiesoag.my.site.com · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Aug 13 | |
| California AGresidents of CA | Sep 2 | |
| Washington AGresidents of WA | Sep 2 | 628 |
| Researchtotal | Sep 2 | |
| Texas AGresidents of TX | Sep 3 | 481 |
History of this record
- 2026-09-25 · data_types: ["names","other"] to ["names","other","ssn","government-id","health","dob","addresses"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 23737 · backfill source
- 2026-09-25 · data_types: [] to ["names","other"] · seed source
- 2026-09-25 · summary: empty to See's Candies said an unauthorized user accessed its network from April 11 to 13, 2026 and encrypted files after taking some of them, and that some stolen files were published on the dark web. It notified affected individuals in September. · seed source
- 2026-09-25 · title: empty to See's Candies ransomware attack leaks files with personal data on dark web · seed source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · discovered: empty to 2026-04-12 · backfill source
- 2026-09-25 · disclosed: 2026-09-02 to 2026-08-13 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.