See's Candies, Inc., the 105-year-old California chocolatier owned by Berkshire Hathaway, has notified individuals that an unauthorized user accessed portions of its computer network in April 2026, encrypted files on a subset of its servers, and copied files that later surfaced on the dark web. The company filed a breach notice with the California Attorney General and has begun mailing "Notice of Data Breach" letters. Four months after the intrusion window, See's has still not publicly enumerated which categories of personal information were exposed, and no source in this review provides a victim count. Plaintiffs' firms are already recruiting class members.
What Happened
The core timeline is consistent across the available reporting, all of which traces back to See's own regulatory filing. The company states that unauthorized access to its network occurred between April 11 and April 13, 2026, and that it was alerted to the intrusion on April 12, 2026, while the actor was still inside. Class Action U, summarizing the California AG notice, records the same April 11-13 window with an April 12 discovery date. See's says it engaged outside cybersecurity specialists immediately and notified law enforcement.
Accounts diverge on discovery. Emery Reddy cites independent breach-tracking reporting from Breachsense that places discovery around May 1, 2026, roughly three weeks later than the date in the company's own notice. Both sources here are OTHER-tier, and neither publishes the underlying documentation. The safest reading is that April 12 is the date See's says it was notified of unauthorized access, while early May may reflect when the scope of data theft or the dark web posting became apparent. That distinction matters for any regulatory clock that runs from discovery.
Attribution is thinner. Emery Reddy, relaying Breachsense, attributes the intrusion to the Qilin ransomware group. That claim rests on a single OTHER-tier source citing another OTHER-tier tracker. It is plausible on its face, since Qilin is a high-volume ransomware-as-a-service operation that pairs encryption with a leak site, and the encrypt-then-leak pattern described in the notice matches that model. It should be treated as a reported attribution, not a confirmed one. See's has not publicly named an actor.
What the company has confirmed is the shape of the event: an intruder reached network systems, encrypted files on some portion of the server estate, exfiltrated files before encrypting them, and some of that data subsequently appeared on the dark web.
What Was Taken
This is where the disclosure is thinnest, and the gap is the story.
See's initially reported that it could not determine whether any files had been removed from its systems. As the forensic review progressed, the company revised that position: the unauthorized actor had copied certain files prior to encryption. Class Action U describes the confirmed data as names in combination with additional personal information categories that have not been specifically disclosed. Emery Reddy makes the same point more bluntly, noting that months after the incident the company still has not told the public which categories of personal information were actually exposed.
No source provides a record count. Not the company notice as summarized, not the litigation sites, not the breach trackers cited. Any figure circulating elsewhere should be treated with suspicion until See's files an updated notice or a state regulator publishes an affected-individual total.
The population at risk is worth sizing even without a count. Wikipedia records See's as operating more than 200 retail stores across 22 states plus international locations, with 1,500 year-round employees and more than 6,000 seasonal workers. Third-party data aggregated on LinkedIn profiles lists a much smaller figure of 600 to 700 employees across 10 countries, which likely reflects corporate headcount rather than retail and seasonal staff. Reporting describes the affected group variously as customers and as employees. A retailer with a large e-commerce operation, a corporate quick-ship business, and a heavily seasonal workforce holds both consumer payment and order data and employee HR and payroll data, and both are plausible contents of an encrypted file server.
Why It Matters
Three things make this case worth a defender's attention beyond the brand name.
First, the disclosure gap. An intrusion window in mid-April, a dark web posting, and still no published data-category list in mid-August is a long time for affected individuals to sit without knowing whether to freeze credit, rotate passwords, or watch for tax fraud. It is also exactly the fact pattern that draws class-action attention, and it has. Emery Reddy and Class Action U are both actively soliciting claimants. For security leaders, the lesson is that forensic uncertainty is not a defense in litigation; the absence of a category list becomes the allegation.
Second, See's had a security function in place. Public professional profiles show a Director of Information Security carrying PCIP and ISA credentials, in the role since July 2024 after eight years as the company's information security manager, plus an IT business systems manager overseeing POS and workforce systems. This was not an organization without a security owner. Ransomware operators are routinely getting past staffed, PCI-conscious mid-market security programs, and a retail environment spanning 200-plus stores, international operations, and a seasonal workforce surge presents an attack surface that headcount alone does not close.
Third, the optics of continuity. On July 30, 2026, more than three months after the intrusion, See's issued a national PR Newswire release launching its fourth annual DOGust shelter-dog campaign, with no reference to the security incident. There is nothing improper about a company continuing its marketing calendar during an investigation, but the contrast between a well-resourced public communications operation and a still-incomplete breach disclosure is precisely the contrast plaintiffs' counsel will draw.
The Attack Technique
The initial access vector has not been disclosed. See's describes unauthorized access to portions of its computer network followed by encryption of files on a subset of servers. That is consistent with a conventional ransomware intrusion chain, most commonly beginning with valid credentials on an internet-facing remote access service, an unpatched edge appliance, or a phishing-delivered loader, followed by lateral movement, staging, exfiltration, and then encryption. Nothing in the sources confirms which of these applied here.
Two other data-theft campaigns appear in the source set, and it is worth being explicit that neither has been connected to See's Candies. They are included as environmental context for retailers running the same SaaS stack, not as an explanation of this incident.
BleepingComputer reported on August 12, 2026, on an ongoing campaign that SaaS security firm Reco dubbed City-Forum, which steals data exposed to anonymous guest users through Salesforce Experience Cloud and ServiceNow customer portals. Reco traced the activity to a single server at 158.220.87.79, hosted by German VPS provider Contabo and associated with the city-forum.com domain, which has resolved there since at least March 2025. The attacker almost always uses the default Go-http-client/1.1 user agent. Reco says the volume is climbing and that only guest-user activity has been observed so far, though authenticated activity cannot be ruled out. Critically, these attacks exploit no vulnerability in either platform. They harvest data that customers themselves exposed through overly permissive sharing rules and portal configuration.
Mitiga's research on the related ShinyHunters activity against Salesforce makes the same structural point: a publicly exposed Experience site with a misconfigured Guest User Profile lets any unauthenticated visitor on the internet reach internal CRM objects through the /s/sfsites/aura endpoint. Mitiga reports that a legitimate Mandiant-built auditing tool was repurposed to exploit this at scale, that 300 to 400 organizations were breached, and that most still do not know it happened. There is no patch, because there is no vulnerability. Mitiga also notes that stolen data does not stay put; it is resold and returns as targeted phishing and identity fraud, which is the downstream risk for anyone whose data left See's servers in April.
What Organizations Should Do
- Decide your data-category disclosure position before you need it. The single largest reputational and legal cost visible in this incident is not the encryption, it is the four-month silence on what was taken. Build the forensic capability to enumerate data categories from backups and file inventories quickly, and pre-draft the notification language so legal review is not the bottleneck.
- Audit SaaS guest-user exposure now. For every Salesforce Experience Cloud site and ServiceNow portal, review Guest User Profile permissions, object-level access, and sharing rules. Assume anything reachable by an unauthenticated guest is already collected. Hunt retroactively for the Reco indicators: requests from 158.220.87.79, the city-forum.com domain, and anomalous Go-http-client/1.1 user agents in portal access logs.
- Instrument for exfiltration, not just encryption. See's was notified of the intrusion on April 12, inside the access window, yet the actor still copied files and posted them. Detection that fires only on mass file modification arrives after the data is gone. Add egress volume baselining and alerting on large outbound transfers from file servers.
- Segment the seasonal and retail estate from corporate file servers. A 200-store footprint with a workforce that expands several times over each holiday season means a large, transient identity population. Enforce least privilege on the file shares that hold HR, payroll, and customer order data, and expire seasonal accounts automatically.
- Treat encrypted-plus-leaked as a data breach from hour one. Starting from the assumption that files were only encrypted and revising later, as happened here, costs both notification time and credibility. Default to exfiltration-occurred until forensics proves otherwise.
- Prepare affected individuals for the second wave. As Mitiga notes, leaked records circulate and return as targeted phishing and identity fraud. Anyone who received a See's notification letter should place credit freezes, treat any See's-branded email or call about the breach as suspect, and verify contact through official channels rather than links in inbound messages.
Sources: See's Candies Data Breach Lawsuit Emery Reddy | "City-Forum" data-theft attacks target Salesforce, ServiceNow portals | See's Candies Data Breach Lawsuit - Class Action U | Ruben Khuda | Chris Chang | See's Candies | See's Candies Kicks Off Fourth Annual DOGust Campaign, Continues Pa... | ShinyHunters: Salesforce’s Uninvited Guest User Profile Breach Mitiga