Hannaford Data Breach: The Victims Fight Back

Credit EligibleAs a BankInfoSecurity.com annual member, this content can be used toward your membership credits and transcript tracking. Click For More Info

Scores of financial institutions received alerts from Visa and MasterCard this past week in the wake of news from the Maine-based Hannaford Brothers grocery chain that 4.2 million customer card transactions were compromised by hackers.

More than 1,800 of those credit card numbers have already been used for fraudulent transactions. Affected by the breach were all 165 Hannaford stores in New England and New York, 106 Sweetbay stores in Florida and 24 independent stores that carry Hannaford products in the Northeast. Hannaford and Sweetbay are owned by the Belgian supermarket chain Delhaize America.

Within two days of the breach announcement, two class action lawsuits on behalf of customers were filed against the retailer. The suits charge Hannaford was negligent for failing to provide adequate security for computer data.

Although the case is among the largest security breaches on record, it is much smaller than the 45 million credit cards taken earlier from TJX, a Framingham, MA., retail chain with 2,500 stores including T.J. Maxx and Marshalls store chains. (SEE RELATED STORY:)

The Damage
At least 60 to 70 Massachusetts banks have received alerts from Visa and MasterCard about thousands of exposed credit and debit cards caught in a new data breach, says Daniel J. Forte, president and CEO of the Massachusetts Bankers Association (MBA).

"The affected accounts appear to be located in banks in Massachusetts and northern New England," Forte says. The MBA has been in discussions with the card companies, as well as pursuing legislative remedies that would change card company rules and require release of the name of the offending retailer, as well as place liability for the costs associated with a breach with the retailer. The association demanded that the credit card companies name the retailer, and later Hannaford stepped forward and acknowledged the breach (SEE HANNAFORD ANNOUNCEMENT).

Click to Get Updates on the Latest Information Security News

Company* Title* Email* Subscription Type: HTML Text Healthcare Enews General Healthcare Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Government Enews General Government Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Banking Enews General Banking Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Credit Union Enews General Credit Union Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Need Help?

Maine credit unions say 100,000 credit and debit cards are expected to be reissued because of the Hannaford breach.

"Because the compromise occurred at a major Maine retailer that so many Maine people use on a regular basis, the impact and cost of this compromise will be significantly higher than the TJX compromise last year," says Rebekah Higgins, Card Services Manager at Synergent, the service subsidiary of the Maine Credit Union League, which handles card services and processing for many Maine credit unions. She says a number of credit unions have already begun reissuing their entire card base.

Vermont banks and credit unions are also carefully watching their customers' cards for fraud after the Hannaford breach. Heritage Family Credit Union in Rutland, VT posted a message on its Web site, www.hfcuvt.com. The message says it will send letters to its members that have had their cards identified by Visa as part of the breach, as soon as the card numbers are released to the credit union.

A 2007 data security breach law passed in Vermont now requires prompt notification of a data security breach. The law covers non-financial companies. It requires businesses and state agencies to notify consumers in the event of a security breach that compromises the security, confidentiality or integrity of certain personal information maintained by the state agency or business.

What Happened?
While the United States Secret Service and other forensic investigators are still unraveling exactly where and how the card data was taken, there are some known facts: * Hannaford became aware of the breach Feb. 27. * Investigators brought in to find the cause determined the data breach began on Dec. 7. * Hannaford didn't stop it until March 10.

Hannaford says the sensitive data was exposed when shoppers swiped their cards at checkout line machines and the information was transmitted to banks for approval. Hannaford doesn't store credit card information in its databases, but uses a wired network to transfer information, according to a Hannaford spokesperson.

There are many past cases where hackers broke into databases to capture card data. The Hannaford breach may be an attack on data in transit, says Gartner analyst Avivah Litan. "The PCI (Payment Card Industry) standards may need updating to say 'data in transit' - even on private networks - must be encrypted, or the network segment processing card data needs to be sufficiently segmented from the rest of the store's networks," Litan says.