HMC Farms Data Breach
The 2026 HMC Farms data breach was confirmed through two official California Attorney General records filed for McClarty Farms LLC and Cabot Packing LLC. Both records publish the same notice letter and identify the same June 5, 2026 network incident; the number of affected people was not publicly disclosed.
The organization has not published how many were affected, so the incident cannot be placed on this scale.
Exposed Data Types
4- Names
- Social security numbers
- Employee records
- Physical addresses
About This Breach
The notice letter is issued by The HMC Group Marketing, Inc. HMC Farms is a family-owned California grower, packer, shipper, and marketer of fruit, while McClarty Farms and Cabot Packing are the company names listed in the regulator records.
How Did the Breach Happen?
HMC detected unusual activity involving its computer networks on June 5 and began an investigation with outside specialists. The review found that some employee personal information may have been accessed or downloaded. The process of identifying affected people was completed on June 23.
What Information Was Affected?
The public sample letter confirms that employee personal information was involved but does not display the specific data fields. Notice recipients should rely on the scope stated in their own letters.
What Response Did HMC Farms Disclose?
The company said it was reviewing existing policies and procedures and implementing enhanced safeguards. Notice recipients were offered 12 months of credit monitoring, a credit report and credit score, and fraud-assistance services at no charge.
What Should Affected People Do?
Affected employees should review the enrollment period and activation steps in their letters and monitor credit reports and account activity for unfamiliar transactions. Links or calls seeking personal information should be verified through the official HMC Farms website or a confirmed contact channel in the notice letter.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
