The California Office of the Attorney General disclosed a data breach affecting Refresco Beverages US Inc. in November 2023, initially detected on May 14, 2023. The incident involved unauthorized access to personal information of current and former employees, exposing personally identifiable information (PII) and personal health information (PHI). The exact number of impacted individuals remains undisclosed, but the breach poses significant risks due to the sensitivity of the compromised data. Employee records, including financial, identity, and health-related details, may have been exposed, increasing vulnerabilities to identity theft, fraud, or targeted phishing attacks. The breach underscores critical gaps in data protection measures, particularly concerning internal workforce data, which could lead to regulatory scrutiny, reputational harm, and potential legal liabilities for the company.

In March 2023, Refresco Beverages US Inc. experienced a data breach where an unauthorized party accessed its computer network, compromising sensitive personal information of current and former employees. The exposed data included names, dates of birth, Social Security numbers, addresses, financial account numbers, driver’s license numbers, health insurance policy numbers, and health-related details tied to workers’ compensation and Americans with Disabilities Act accommodations. The breach led to a class action lawsuit, alleging the company failed to adequately safeguard the data. Refresco agreed to a $650,000 settlement, offering affected employees up to $5,000 in compensation for documented losses, out-of-pocket expenses, and time spent resolving breach-related issues. The incident underscored vulnerabilities in the company’s cybersecurity measures, resulting in potential identity theft, fraud, and financial harm to impacted individuals.