Hy-Vee Announces Payment Card Breach

guest · Aug 15, 2019

Hy-Vee Announces Payment Card Breach
August 14, 2019
https://www.hy-vee.com/corporate/news-events/announcements/notice-of-payment-card-data-incident/

Notice of Payment Card Data Incident
We want to make customers aware of an investigation we are conducting into a security incident involving our payment processing systems that is focused on transactions at some Hy-Vee fuel pumps, drive-thru coffee shops, and restaurants, as well as to provide information on the measures we have taken in response and steps customers may consider taking as well.

After recently detecting unauthorized activity on some of our payment processing systems, we immediately began an investigation with the help of leading cybersecurity firms.
Because the investigation is in its earliest stages, we do not have any additional details to provide at this time. We will provide notification to our customers as we get further clarity about the specific timeframes and locations that may have been involved.

It is always advisable to closely monitor your payment card statements for any unauthorized activity.
Click to expand...

Minimalist · Aug 22, 2019

Breach at Hy-Vee Supermarket Chain Tied to Sale of 5M+ Stolen Credit, Debit Cards

On Tuesday of this week, one of the more popular underground stores peddling credit and debit card data stolen from hacked merchants announced a blockbuster new sale: More than 5.3 million new accounts belonging to cardholders from 35 U.S. states. Multiple sources now tell KrebsOnSecurity that the card data came from compromised gas pumps, coffee shops and restaurants operated by Hy-Vee, an Iowa-based company that operates a chain of more than 245 supermarkets throughout the Midwestern United States.
Click to expand...

https://krebsonsecurity.com/2019/08...tied-to-sale-of-5m-stolen-credit-debit-cards/

guest · Oct 3, 2019

mood said: ↑

Hy-Vee Announces Payment Card Breach
August 14, 2019
https://www.hy-vee.com/corporate/news-events/announcements/notice-of-payment-card-data-incident/
Click to expand...

Hy-Vee Reports Findings from Investigation of Payment Card Data Incident
October 3, 2019
https://www.hy-vee.com/corporate/ne...-investigation-of-payment-card-data-incident/

Hy-Vee is providing additional information about the payment card incident that we first reported on August 14, 2019. This following information further explains the incident, the measures we have taken, and some steps you can take in response.

The malware searched for track data (which sometimes has the cardholder name in addition to card number, expiration date, and internal verification code) read from a payment card as it was being routed through the POS device
The specific timeframes when data from cards used at these locations involved may have been accessed vary by location over the general timeframe beginning December 14, 2018, to July 29, 2019, for fuel pumps and beginning January 15, 2019, to July 29, 2019, for restaurants and drive-thru coffee shops. There are six locations where access to card data may have started as early as November 9, 2018, and one location where access to card data may have continued through August 2, 2019.
Click to expand...

guest · Oct 18, 2019

Hy-Vee customers hit chain with class action lawsuit over data breach
October 17, 2019
https://www.thegazette.com/subject/...t-over-data-breach-us-court-illinois-20191017

Hy-Vee customers have named the grocer in a class-action lawsuit after a cyber breach compromised payment card data at numerous locations in eight states.

The legal complaint, filed Tuesday in the U.S. District Court for the Central District of Illinois, criticizes the West Des Moines-based retailer for using encryption technology to protect card data at its grocery stores, but not its breached fuel pump, drive-through coffee shop and restaurant locations.

“Despite the well-publicized and ever-growing threat of security breaches involving payment card networks and systems, and despite the fact that these types of data breaches were and are occurring throughout the restaurant and retail industries, Hy-Vee failed to ensure that it maintained adequate data security measures causing customer card information to be stolen,” wrote attorneys representing two named plaintiffs and national, Illinois and Missouri classes of undetermined sizes.
“As a direct and proximate consequence of Hy-Vee’s conduct and data security shortcomings, a massive amount of customer information was stolen from Hy-Vee and exposed to criminals.”
Click to expand...

guest · Nov 30, 2019

Hy-Vee Faces 2nd Lawsuit Over Data Breach
November 27, 2019
https://progressivegrocer.com/hy-vee-faces-2nd-lawsuit-over-data-breach

A data breach at Hy-Vee Inc. has led Kansas City resident Gordon Grewing to file a lawsuit seeking class-action status against the grocer, alleging that it acted too slowly after the breach was discovered and didn’t provide assistance to the millions of affected customers, according to a published report.

This is the second lawsuit to be filed in connection with the breach. In October, Pennsylvania law firm Chimicles Schwartz Kriner & Donaldson-Smith (CSK&D) filed a class action complaint in the U.S. District Court for the Central District of Illinois against the grocer.

Grewing noted in his suit that he shopped at a Hy-Vee in Kansas City, using his CommunityAmerica Credit Union debit card at the gas pumps and Hy-Vee Market Grille, the Kansas City Business Journal reported.
On Nov. 12, CommunityAmerica notified Grewing that someone had tried to use his card twice to spend $517.08 on Airbnb.com in San Fransisco.
Grewing’s suit accuses Hy-Vee of negligence, breach of implied contract, violations of the Missouri Merchandising Practices Act and unjust enrichment.
Click to expand...

guest · Jan 14, 2021

Hy-Vee Data Breach Settlement Proposed
January 14, 2021
https://www.infosecurity-magazine.com/news/hy-vee-data-breach-settlement/

A preliminary settlement agreement regarding a data breach that impacted customers of Iowa-based grocery store chain Hy-Vee has been proposed.

Hy-Vee launched an investigation after detecting unauthorized activity on some of its payment processing systems on July 29, 2019.
The investigation found that malware designed to access and steal payment card data from cards used on point-of-sale (POS) devices had been installed at certain Hy-Vee fuel pumps and drive-thru coffee shops.
Click to expand...

On January 12, a settlement agreement was proposed that would allow those affected by the breach to submit reimbursement claims for a maximum of $225. The plaintiffs who are named in the suit are earmarked to receive an additional $2,000 "incentive award."
Under the proposal, customers who faced "extraordinary expenses" because of the data breach, such as hefty, unreimbursed fraudulent charges, may claim up to $5,000.
Click to expand...

Log in or Sign up

Hy-Vee Announces Payment Card Breach

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Hy-Vee Announces Payment Card Breach

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches