WEST DES MOINES, Iowa — Hy-Vee is investigating a security incident involving its payment processing systems, according to a statement from the chain. The supermarket and convenience-store retailer is focusing its investigation on transactions at some Hy-Vee fuel pumps, drive-thru coffee shops and restaurants.
Hy-Vee did not offer a time frame or locations that may have been involved, and it said in its statement that the investigation is in its “earliest stages.”
Restaurants in question include Market Grilles, Market Grille Expresses and the Wahlburgers locations that Hy-Vee owns and operates. These sites operate on different payment processing platforms than those in Hy-Vee’s grocery stores, drugstores and inside its convenience stores, which use point-to-point encryption (P2PE). P2PE refers to data that is encrypted from the point where the card is swiped or dipped until the payment data reaches the payment processor.
If Hy-Vee’s fuel pumps, restaurants and other sites under investigation do not use P2PE, they could be at higher risk of a data breach compared to systems using P2PE.
Hy-Vee has also notified federal law enforcement and the payment card networks of the potential breach and is investigating with the help of cybersecurity firms. The chain believes its actions have stopped what it referred to as “unauthorized activity” in its payment processing systems. The supermarket also said it believes its front-end checkout lanes, pharmacies, customer service counters, wine and spirits locations, floral departments, clinics and all other foodservice areas, as well as transactions processed through Aisles Online, were not involved in the potential cyberattack.
The chain’s statement also cautions customers to monitor payment card statements for any unauthorized activity. Equifax and Panera were also victims of cyberattacks in the past and were criticized for not alerting customers quickly. Hy-Vee has not received the same criticism for its handling of the alleged attack.
West Des Moines, Iowa-based Hy-Vee Inc. is one of the largest privately owned U.S. supermarket chains. It also operates more than 150 Hy-Vee Gas convenience stores with fuel in the parking lots of its grocery stores in Illinois, Iowa, Kansas, Minnesota, Missouri, Nebraska, South Dakota and Wisconsin. Hy-Vee Inc. is No. 42 on CSP's 2019 Top 202 list of c-stores by store count.
Members help make our journalism possible. Become a CSP member today and unlock exclusive benefits, including unlimited access to all of our content. Sign up here.