Sunsweet Growers Inc. Data Breach — Class Action Review

Sunsweet Growers Inc. is a major agricultural cooperative and prominent global processor and marketer of dried fruits, prunes, and related food products. Operating within the agricultural, food production, and supply chain sectors, the organization maintains extensive business operations that require the collection, processing, and storage of substantial volumes of sensitive information. Because Sunsweet manages a vast network of agricultural growers, agricultural workers, corporate employees, vendors, and commercial partners across multiple states including New Hampshire, the company holds high-value personal data. This typically includes comprehensive human resources records, detailed payroll and compensation files, sensitive tax documentation, and proprietary operational logs necessary to coordinate agricultural supply, processing, and distribution.

In 2025, Sunsweet Growers Inc. formally reported a security incident to the New Hampshire Attorney General's Office, alerting authorities and affected individuals to an unauthorized party's access to its network infrastructure. In the food production and agricultural supply sector, incidents of this nature frequently involve sophisticated cyberattacks, such as ransomware deployments, unauthorized intrusions into corporate databases, or compromises of third-party vendor systems integrated into enterprise resource planning software. Threat actors increasingly target agricultural and manufacturing enterprises because these organizations often maintain centralized networks connecting administrative offices, processing facilities, and remote grower databases, creating multiple potential entry points for unauthorized data exfiltration.

The data compromised in the Sunsweet Growers Inc. incident typically includes sensitive personally identifiable information (PII) belonging to current and former employees, agricultural workers, and administrative personnel. Depending on the scope of the breach, exposed records may feature full names, Social Security numbers, dates of birth, home addresses, wage and compensation details, and direct deposit account numbers. The exposure of this information creates severe, immediate risks for victims. Social Security numbers and dates of birth are the foundational building blocks for identity theft, enabling malicious actors to open fraudulent credit accounts, secure unauthorized loans, or intercept government benefits. Furthermore, leaked banking and tax information leaves victims acutely vulnerable to direct financial account takeover and fraudulent tax return filings.

Under applicable state data protection statutes, including the New Hampshire data breach notification law, as well as overarching common law duties, Sunsweet Growers Inc. had an affirmative legal obligation to implement and maintain reasonable and appropriate security measures to safeguard the sensitive personal information entrusted to its care. Organizations that collect and store employee and partner data are required to deploy robust technical safeguards, such as end-to-end encryption, multi-factor authentication, network segmentation, and regular vulnerability assessments. The occurrence of a data breach resulting in the exfiltration of sensitive records strongly suggests a systemic failure of these foundational cybersecurity duties, raising significant questions regarding whether the company's protective protocols met industry standards.

For individuals who have received a formal data notification letter from Sunsweet Growers Inc., this document serves as an official acknowledgment that their private data was compromised due to corporate security failures. Legally, the receipt of this notice establishes the necessary standing to participate in a class action lawsuit aimed at securing accountability and financial compensation. Importantly, affected individuals are not required to demonstrate actual out-of-pocket financial loss to join a class action; the increased, imminent risk of identity theft and the forced burden of lifelong credit monitoring constitute legally cognizable harms. Our firm evaluates these data breach cases on a strict contingency fee basis, meaning affected individuals pay nothing out of pocket, and legal fees are recovered only if a successful resolution or settlement is achieved.