EDEN PRAIRIE, Minn. -- SuperValu Inc. announced that it experienced a criminal intrusion into the portion of its computer network that processes payment card transactions for some of its retail food stores and liquor stores.
The company said it believes that the payment cards from which such cardholder data may have been stolen were used during the period of June 22 through July 17, 2014, at the 180 SuperValu stores and liquor stores listed at www.supervalu.com under its "Consumer Security Advisory" section, operated under the Cub Foods, Farm Fresh, Hornbacher's, Shop 'n Save and Shoppers Food & Pharmacy banners.
The intrusion may also have resulted in the theft of such cardholder data from some cards used during this period at 29 franchised Cub Foods stores and liquor stores, which are included in the store list referenced on the SuperValu website.
In addition, some stores owned and operated by Albertson's LLC, Boise City, Idaho, and New Albertson's Inc., Spokane, Wash., suffered similar criminal intrusion, since SuperValu provides IT services to those companies, SuperValu officials said. They s included Albertsons stores under Albertson's LLC and ACME Markets, Jewel-Osco and Shaw's and Star Markets under New Albertson's Inc.
Based on information we have at this time, Albertsons stores in Arizona, Arkansas, Colorado, Florida, Louisiana, New Mexico, Texas and our two Super Saver Foods Stores in Northern Utah were not impacted by this incident. However, Albertsons stores in Southern California, Idaho, Montana, North Dakota, Nevada, Oregon, Washington, Wyoming and Southern Utah were impacted. In addition, ACME Markets in Pennsylvania, Maryland, Delaware and New Jersey; Jewel-Osco stores in Iowa, Illinois and Indiana; and Shaw's and Star Markets stores in Maine, Massachusetts, Vermont, New Hampshire and Rhode Island were all affected by this incident.
The revelation follows the recent potential data theft at restaurant chain P.F. Chang's, as well as news from Hold Security, Milwaukee, which claims to have identified a Russian organization responsible for the theft of up to 1.2 billion user names and passwords. It also follows the early high-profile data breach at Target.
Continued on next page.
With the Eden Prairie, Minn.-based SuperValu, the criminal intrusion may have resulted in the theft of account numbers, and in some cases also the expiration date, other numerical information and possibly the cardholder's name, from payment cards used at some point-of-sale (POS) systems at some of the company's owned and franchised stores.
The company has not determined that any such cardholder data was in fact stolen by the intruder, and it has no evidence of any misuse of any such data, but made the announcement "out of an abundance of caution."
SuperValu said it currently believes that the intrusion did not affect any of its owned or licensed Save-A-Lot stores or any of the independent grocery stores supplied by the company through its independent business network other than the aforementioned franchised Cub Foods stores.
Upon recognition of the intrusion, the company took steps to secure the affected part of its network. An investigation supported by third-party data forensics firm is ongoing to understand the nature and scope of the incident, officials said. SuperValu believes the intrusion has been contained.
"The safety of our customers' personal information is a top priority for us," said Sam Duncan, president and CEO of SuperValu. "The intrusion was identified by our internal team, it was quickly contained, and we have had no evidence of any misuse of any customer data. I regret any inconvenience that this may cause our customers but want to assure them that it is safe to shop in our stores."
The company said it notified federal law enforcement authorities and is cooperating in their efforts to investigate this intrusion and identify those responsible.
SuperValu has established a call center to answer customer questions about the intrusion and the identity protection services being offered.
Customers are not responsible for counterfeit fraudulent charges on their credit cards or debit cards that are timely reported, the company said. Accordingly, if customers become aware of such activity, they should contact their issuing bank immediately, officials said.
SuperValu Inc. is one of the largest grocery wholesalers and retailers in the United States with annual sales of approximately $17 billion. It has 3,320 stores--1,805 independent stores serviced primarily by the company's food distribution business; 1,325 Save-A-Lot stores, of which 931 are operated by licensee owners; and 190 traditional retail grocery stores.
AB Acquisition LLC, which operates ACME, Albertsons, Jewel-Osco, Lucky, Shaws, Star Market and Super Saver, and stores under the United Family of stores, Amigos, Market Street and United Supermarkets, is privately owned by Cerberus Capital Management, Kimco Realty Corp., Klaff Realty, Lubert-Adler Partners and Schottenstein Stores Corp. and operates 1,060 stores and 14 distribution centers in 29 states.
Members help make our journalism possible. Become a CSP member today and unlock exclusive benefits, including unlimited access to all of our content. Sign up here.