Supervalu Investigating Potential Data Breach

By Dow Jones Business News, 
A A A

Supervalu Confirms Data Breach


Supermarket chain Supervalu Inc. confirmed that it is investigating a data breach at roughly 200 of its grocery and liquor stores in an incident that also stretched to hundreds of other stores around the country that it recently sold.

In addition to Supervalu's own brands that include Cub Foods, Hornbacher's and Farm Fresh, the breach hit the Albertsons, Acme Markets, Jewel-Osco, Shaw's and Star Markets brands in roughly two dozen states.

Supervalu provides technology services to those stores, which were acquired by private-equity firm Cerberus Capital Management from Supervalu last year.

Supervalu and AB Acquisition LLC, which is the parent of the Cerberus-owned stores, confirmed the breach that was reported on Thursday by The Wall Street Journal. People familiar with the situation said then that as many as 1,000 stores may have been affected.

Supervalu described the breach as a "criminal intrusion" that may have resulted in the theft of account numbers, expiration dates and cardholder names from customers who used plastic at the stores.

"The company has not determined that any such cardholder data was in fact stolen by the intruder, and it has no evidence of any misuse of any such data, but is making this announcement out of an abundance of caution," Supervalu said. The company is conducting a forensic investigation and is working with federal authorities.

The breach appears to have taken place between June 22 and July 17, the companies said. It may have may have resulted from hackers installing malicious software onto the company's point-of-sale network, said people familiar with the situation. That is the system that includes the cash register and terminals that handle credit card and debit card transactions.

Supervalu, which listed its affected stores online, said it has set up a call center to take customer questions about the breach and is offering 12 months of free identity protection services to customers whose cards may have been affected.

AB Acquisition said it is working with Supervalu "to better understand the nature and scope of the incident." It wasn't immediately clear exactly how many of its stores were affected.

"We understand the inconvenience and concern an incident like this can cause, and we deeply regret that our customers' data was targeted, " said Mark Bates, senior vice president and chief information officer at AB Acquisition in a statement.

An attack on the company's point-of-sale system would be similar to other recent high-profile data breaches, most notably the massive hack that occurred at Target Corp. during the winter holiday-shopping season. In the incident, thieves stole 40 million payment-card numbers and the personal information of 70 million shoppers.

Since then, hackers also have taken aim at a number of merchants, including luxury retailer Neiman Marcus Group, restaurant chain P.F. Chang's China Bistro Inc., and Goodwill Industries International Inc. thrift stores.

The spate of data breaches recently has raised questions about whether companies should always notify their customers, vendors and authorities immediately after breaches. Some executives believe such incidents should be kept quiet if valuable information is stolen, even if it might be compromised.

Breaches also are costly for banks, which usually bear the cost of fraud on cards they have issued. U.S. credit-card fraud losses totaled roughly $18 billion last year, according to Javelin Strategy & Research, a consulting firm that is a unit of Greenwich Associates.

The Supervalu investigation comes at a time when banks and merchants are racing to roll out new technology to make card transactions safer. Banks are ramping up plans to issue cards that contain a computer chip that creates a unique code for each transaction, making card data less valuable to thieves.

Merchants, meanwhile, are upgrading their computer terminals to accept the new chip cards, which have been used for years in Europe, Asia and Canada.

The supermarket industry has been roiled in recent years by a wave of mergers and acquisitions. Cerberus, which owns a minority stake in Supervalu, has been especially active and earlier this year agreed to buy Safeway Inc.

Supervalu has struggled more than other major grocery chains to keep customers amid pressure from Wal-Mart Stores Inc., drugstores and dollar stores ramping up their food sales. Supervalu has brought in a new chief executive, sold five of its grocery-store chains and eliminated up to 1,100 positions from its corporate and store-support-center offices.

Supervalu had sales of roughly $17 billion last year. It is the 7th-largest U.S. grocery chain with a 2.1% share and operates under brands such as Cub Foods, Farm Fresh and Save-A-Lot.

Most of Supervalu's stores are independently run but receive their goods from Supervalu.

Annie Gasparro contributed to this article.

Write to Robin Sidel at robin.sidel@wsj.com

Subscribe to WSJ: http://online.wsj.com?mod=djnwires


  (END) Dow Jones Newswires
  08-14-142115ET
  Copyright (c) 2014 Dow Jones & Company, Inc.


This article appears in: Technology

Referenced Stocks: SVU , SWY , TGT , WMT

Dow Jones Business News


More from Dow Jones Business News:

Related Videos

Stocks

Referenced

Most Active by Volume

60,528,717
  • $102.20 ▲ 2.45%
44,443,034
  • $16.4827 ▲ 1.37%
43,116,998
  • $12.9752 ▼ 7.32%
33,569,643
  • $40.65 ▼ 6.10%
25,606,723
  • $9.285 ▲ 1.36%
25,382,846
  • $96.22 ▲ 1.94%
22,215,011
  • $30.67 ▲ 3.30%
19,567,255
  • $3.48 ▼ 10.77%
As of 10/21/2014, 01:10 PM