Refresco Beverages US Inc.

In March 2023, Refresco Beverages US Inc. experienced a data breach where an unauthorized party accessed its computer network, compromising sensitive personal information of current and former employees. The exposed data included names, dates of birth, Social Security numbers, addresses, financial account numbers, driver’s license numbers, health insurance policy numbers, and health-related details tied to workers’ compensation and Americans with Disabilities Act accommodations. The breach led to a class action lawsuit, alleging the company failed to adequately safeguard the data. Refresco agreed to a **$650,000 settlement**, offering affected employees up to **$5,000** in compensation for documented losses, out-of-pocket expenses, and time spent resolving breach-related issues. The incident underscored vulnerabilities in the company’s cybersecurity measures, resulting in potential identity theft, fraud, and financial harm to impacted individuals.

Source: https://www.claimdepot.com/settlements/refresco-data-breach

Refresco cybersecurity rating report: https://www.rankiteo.com/company/refresco

"id": "ref2650626110725",
"linkid": "refresco",
"type": "Breach",
"date": "3/2023",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'customers_affected': 'Current and former employees '
                                              '(exact number unspecified)',
                        'industry': 'Food & Beverage',
                        'location': 'United States',
                        'name': 'Refresco Beverages US Inc.',
                        'type': 'Beverage Manufacturer'}],
 'data_breach': {'data_exfiltration': 'Likely (data accessed by unauthorized '
                                      'party)',
                 'personally_identifiable_information': ['Names',
                                                         'Dates of birth',
                                                         'Social Security '
                                                         'numbers',
                                                         'Addresses',
                                                         'Driver’s license '
                                                         'numbers'],
                 'sensitivity_of_data': 'High (SSNs, financial, health data)',
                 'type_of_data_compromised': ['Personally Identifiable '
                                              'Information (PII)',
                                              'Protected Health Information '
                                              '(PHI)',
                                              'Financial Information']},
 'date_detected': '2023-03',
 'date_publicly_disclosed': '2023-11',
 'description': "An unauthorized party accessed Refresco Beverages US Inc.'s "
                'computer network in March 2023, potentially exposing '
                'sensitive personal information of current and former '
                'employees. The breach compromised names, dates of birth, '
                'Social Security numbers, addresses, financial account '
                'numbers, driver’s license numbers, health insurance policy '
                'numbers, and certain health information. Refresco agreed to a '
                '$650,000 class action settlement to resolve allegations of '
                'inadequate safeguards.',
 'impact': {'brand_reputation_impact': 'Class action lawsuit and settlement',
            'data_compromised': ['Names',
                                 'Dates of birth',
                                 'Social Security numbers',
                                 'Addresses',
                                 'Financial account numbers',
                                 'Driver’s license numbers',
                                 'Health insurance policy numbers',
                                 'Health information (workers’ compensation, '
                                 'ADA accommodations)'],
            'financial_loss': {'administration_costs': 'To be determined',
                               'attorneys_fees': '$216,666.67',
                               'claimant_payouts': 'Remaining funds after '
                                                   'deductions',
                               'settlement_amount': '$650,000'},
            'identity_theft_risk': 'High (SSNs, financial data exposed)',
            'legal_liabilities': '$650,000 settlement',
            'payment_information_risk': 'High (financial account numbers '
                                        'exposed)',
            'systems_affected': ['Computer network']},
 'initial_access_broker': {'high_value_targets': ['Employee PII/PHI data']},
 'investigation_status': 'Settled (class action lawsuit resolved)',
 'post_incident_analysis': {'corrective_actions': 'Settlement agreement (no '
                                                  'technical remediation '
                                                  'details disclosed)',
                            'root_causes': 'Alleged failure to adequately '
                                           'safeguard sensitive personal '
                                           'information'},
 'references': [{'source': 'Class Action Settlement Notice'},
                {'source': 'Settlement Administrator (Refresco Data Breach '
                           'Settlement)'}],
 'regulatory_compliance': {'legal_actions': 'Class action lawsuit (settled for '
                                            '$650,000)'},
 'response': {'communication_strategy': 'Notice letters sent to affected '
                                        'individuals (November 2023)'},
 'stakeholder_advisories': 'Notice letters sent to affected employees '
                           '(November 2023)',
 'threat_actor': 'Unauthorized party',
 'title': 'Refresco Beverages US Inc. Data Breach (March 2023)',
 'type': ['Data Breach', 'Class Action Lawsuit']}