Hershey Chocolate Consumers’ Personal Data Stolen

There is no sugar-coating this, reports The Register; cyber thieves are binging on 2,214 peoples’ financial information after a phishing campaign breached the Hershey candy company’s data.

A security notification filed with the Maine Attorney General’s office reveals that phishing emails hit employees’ inboxes in early September. According to Hershey, hackers had access to “a limited number” of the company’s email accounts and “may have had access to certain personal information.”

The company says the stolen data “varied from person to person” but may have included first and last names, health and medical information, digital signatures, contact information, driver’s license numbers, credit card numbers, and credentials for online accounts and financial accounts, including routing numbers.

“Upon learning of the incident, Hershey worked to block the unauthorized user’s access and confirm that the affected Hershey accounts were no longer in use,” according to the breach notification letters.

Hershey has been targeted by hackers before. In 2011, the company’s server was accessed, and one of the baking recipes posted on its website was altered.

The breached server stored consumer registration information, including email addresses, birth dates, and street addresses, as well as recipes.

In June 2023, another sweets company, Mondelez, manufacturer of Oreo cookies, had its employees’ data compromised. That was due to a breach at the Bryan Cave law firm. Bryan Cave provides legal services to Mondolez, as well as other Fortune 500 companies.

According to Mondelez, hackers gained access to Bryan Cave’s records, including a storage area for certain customer files, from February 27 to March 1. Bryan Cave hired a cybersecurity firm to investigate and notified Mondelez in late March.