Hershey Company notifies residents after phishing attack accessed email accounts in Sept.
The Hershey Company is informing residents of a phishing attack that may have resulted in a hacker accessing more than 2,000 individuals' personal information.
Between Sept. 3 and Sept. 4, "an unauthorized user" gained access to a limited number of Hershey email accounts. The company stated that 2,214 residents in the country are affected, according to a filing the company made with the Maine Attorney General's office.
Hershey spokesman Todd Scott told the Lebanon Daily News Monday that officials worked quickly to disable that access and reach out to residents.
"While we believe that no personally identifiable information was acquired or misused, out of an abundance of caution, we have notified persons in the U.S. whose information may have been impacted," he said.
Hershey officials said they have been working with multiple third parties, including "a forensic provider," to investigate the incident. In a letter to those who may be affected by the breach, officials said the information accessed by the unauthorized user varied from person-to-person.
In the letter, officials suggested that the information accessed may have included health and medical information, health insurance information, digital signatures, date of birth, address and contact information, credit card numbers with passcode or security code, driver’s license numbers and credentials for online accounts and financial accounts including routing numbers.
The Hershey Company has taken steps to enhance data security measures to prevent a similar event in the future, including forced password changes and additional detection safeguards to their email environment.
As of Monday, officials have not identified a suspect for the phishing incident.
A Pennsylvania Attorney General's office spokesperson told the Lebanon Daily News that they did not have information on the potential impact the Hershey data breach would have on the state. They added that current law does not require businesses to report data breaches to the attorney general's office.
The spokesperson added that with any data breach, residents are recommended to change passwords, review credit reports for unusual activity and sign up for credit monitoring.
Cesar Wilkins Romero-Colon: DA: Officer justified in shooting at armed robbery suspect who led Lebanon police on chase
Information wanted: Lebanon City Police looking for information on an East Cumberland Street shooting
The Hershey Company is offering anyone affected by the breach 24 month of free credit monitoring and identity protection services, according to Scott. Officials will be offering a 24-month membership to Experian Identity Works, which those who are infected will need to enroll by March 31, 2024.
Matthew Toth is a reporter for the Lebanon Daily News. Reach him at mtoth@ldnews.com or on Twitter at @DAMattToth.
This article originally appeared on Lebanon Daily News: Hershey Company involved in phishing attack that accessed personal info
