By Dow Jones Business News,
August 14, 2014, 09:15:00 PM EDT
Supervalu Confirms Data Breach
Supermarket chain Supervalu Inc. confirmed that it is investigating a data breach at roughly 200 of its grocery and
liquor stores in an incident that also stretched to hundreds of other stores around the country that it recently sold.
In addition to Supervalu's own brands that include Cub Foods, Hornbacher's and Farm Fresh, the breach hit the
Albertsons, Acme Markets, Jewel-Osco, Shaw's and Star Markets brands in roughly two dozen states.
Supervalu provides technology services to those stores, which were acquired by private-equity firm Cerberus Capital
Management from Supervalu last year.
Supervalu and AB Acquisition LLC, which is the parent of the Cerberus-owned stores, confirmed the breach that was
reported on Thursday by The Wall Street Journal. People familiar with the situation said then that as many as 1,000
stores may have been affected.
Supervalu described the breach as a "criminal intrusion" that may have resulted in the theft of account numbers,
expiration dates and cardholder names from customers who used plastic at the stores.
"The company has not determined that any such cardholder data was in fact stolen by the intruder, and it has no
evidence of any misuse of any such data, but is making this announcement out of an abundance of caution," Supervalu
said. The company is conducting a forensic investigation and is working with federal authorities.
The breach appears to have taken place between June 22 and July 17, the companies said. It may have may have resulted
from hackers installing malicious software onto the company's point-of-sale network, said people familiar with the
situation. That is the system that includes the cash register and terminals that handle credit card and debit card
Supervalu, which listed its affected stores online, said it has set up a call center to take customer questions about
the breach and is offering 12 months of free identity protection services to customers whose cards may have been
AB Acquisition said it is working with Supervalu "to better understand the nature and scope of the incident." It
wasn't immediately clear exactly how many of its stores were affected.
"We understand the inconvenience and concern an incident like this can cause, and we deeply regret that our customers'
data was targeted, " said Mark Bates, senior vice president and chief information officer at AB Acquisition in a
An attack on the company's point-of-sale system would be similar to other recent high-profile data breaches, most
notably the massive hack that occurred at Target Corp. during the winter holiday-shopping season. In the incident,
thieves stole 40 million payment-card numbers and the personal information of 70 million shoppers.
Since then, hackers also have taken aim at a number of merchants, including luxury retailer Neiman Marcus Group,
restaurant chain P.F. Chang's China Bistro Inc., and Goodwill Industries International Inc. thrift stores.
The spate of data breaches recently has raised questions about whether companies should always notify their customers,
vendors and authorities immediately after breaches. Some executives believe such incidents should be kept quiet if
valuable information is stolen, even if it might be compromised.
Breaches also are costly for banks, which usually bear the cost of fraud on cards they have issued. U.S. credit-card
fraud losses totaled roughly $18 billion last year, according to Javelin Strategy & Research, a consulting firm that is
a unit of Greenwich Associates.
The Supervalu investigation comes at a time when banks and merchants are racing to roll out new technology to make
card transactions safer. Banks are ramping up plans to issue cards that contain a computer chip that creates a unique
code for each transaction, making card data less valuable to thieves.
Merchants, meanwhile, are upgrading their computer terminals to accept the new chip cards, which have been used for
years in Europe, Asia and Canada.
The supermarket industry has been roiled in recent years by a wave of mergers and acquisitions. Cerberus, which owns a
minority stake in Supervalu, has been especially active and earlier this year agreed to buy Safeway Inc.
Supervalu has struggled more than other major grocery chains to keep customers amid pressure from Wal-Mart Stores
Inc., drugstores and dollar stores ramping up their food sales. Supervalu has brought in a new chief executive, sold
five of its grocery-store chains and eliminated up to 1,100 positions from its corporate and store-support-center
Supervalu had sales of roughly $17 billion last year. It is the 7th-largest U.S. grocery chain with a 2.1% share and
operates under brands such as Cub Foods, Farm Fresh and Save-A-Lot.
Most of Supervalu's stores are independently run but receive their goods from Supervalu.
Annie Gasparro contributed to this article.
Write to Robin Sidel at email@example.com
Subscribe to WSJ: http://online.wsj.com?mod=djnwires
(END) Dow Jones Newswires
Copyright (c) 2014 Dow Jones & Company, Inc.