pez.com Listed by abyss Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target consumer brands and mid-sized manufacturers, using data theft as leverage even when operational disruption is limited. Listings on leak sites have become a common pressure tactic in late 2024, often appearing before any independent confirmation of compromise.

On 6 December 2024 the ransomware group known as abyss listed pez.com among its claimed victims, stating that internal files had been exfiltrated. The number of people affected remains unknown, and public detail on the incident is limited to that claim. For a company whose products reach households worldwide, any exposure of internal material raises practical questions about what may have left its systems and who might be affected.

Breaking down the breach

According to the available record, pez.com was listed by the abyss ransomware group on 6 December 2024. The group asserts that internal files were taken during a ransomware attack. No further technical details—such as the initial access method, the precise date of intrusion, the volume of data, or whether encryption was also deployed—have been disclosed publicly. The number of individuals potentially affected is listed as unknown. Because the information originates from a leak-site claim rather than a confirmed disclosure by the company, the listing itself should be treated as an unverified assertion until additional evidence appears.

Who is abyss?

Abyss is a ransomware operation that follows the now-familiar double-extortion model: data is stolen first, then systems may be encrypted, and the threat of public release is used to pressure payment. Groups of this type typically maintain dedicated leak sites where they post victim names, sample files, and countdown timers. Public reporting on abyss has described it as opportunistic rather than highly selective, focusing on organisations that hold commercially useful or sensitive internal material. In this case the group claims pez.com as a victim and states that internal files were exfiltrated; no independent confirmation of those specifics has been supplied in the public record.

About pez.com

PEZ was first marketed as a compressed peppermint candy in 1927 in Vienna, Austria. Today the company sells and markets its products worldwide, with locations in Orange, Connecticut, and Traun, Austria. As a long-established confectionery brand, it maintains manufacturing, distribution, marketing, and corporate functions that generate the usual range of internal business records. A ransomware listing against such an organisation is consequential because consumer brands often hold supplier contracts, employee information, logistics data, and product-development material that can be valuable to competitors or useful for secondary fraud. Even when customer payment-card data is not involved, the mere appearance on a leak site can create operational and reputational pressure.

The information in question

The only data type named in the public record is “internal files exfiltrated in ransomware attack.” Exact contents have not been disclosed. Organisations of this kind typically hold employee records, supplier and distributor agreements, inventory and logistics files, marketing plans, and internal financial documents. Whether any of those categories were among the material claimed by abyss remains unconfirmed. No statement has been released specifying personal data of customers, payment information, or other regulated categories. Until more detail emerges, the precise nature and sensitivity of the files must be regarded as unknown.

The real-world impact

For individuals, the primary near-term risk is secondary misuse of any personal or contact information that may have been present in internal files—such as employee directories, contractor details, or business-partner records. That can lead to targeted phishing, social-engineering attempts, or identity-related fraud. For the organisation the risks include operational distraction, potential regulatory notification obligations if personal data is later confirmed, and the commercial cost of investigating and containing the incident. Because the scale remains unknown and the claim is unverified, the actual impact cannot yet be quantified; the listing alone, however, is sufficient to warrant monitoring and basic protective steps by anyone who has a relationship with the company.

What to do if you're exposed

If you have worked with, supplied, or otherwise shared information with pez.com, treat the listing as a prompt for caution rather than confirmed compromise. Practical first steps include:

• Monitor email and messaging accounts for unexpected requests that reference PEZ or related business relationships.
• Enable multi-factor authentication on any accounts that might share credentials or contact details with the company.
• Review recent financial and credit activity for unfamiliar inquiries if you are an employee or contractor.
• Be sceptical of unsolicited messages that claim to come from PEZ or its partners and that ask for credentials or payments.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach data sets.

Public detail on this incident remains limited. Continued monitoring of official statements from the company and of any further postings by the threat actor will be necessary before the full scope can be assessed.

AICompiled with AI assistance from public sources and published under our editorial standards.