Mid-Western supermarket chain Hy-Vee issued an update regarding the POS data breach it reported in August, including when it happened on the locations involved.
Hy-Vee said in an October 3 release that unauthorized access was detected on July 29, 2019 and focused on Hy-Vee fuel pumps, drive-thru coffee shops, and restaurants at Hy-Vee Market Grilles, Hy-Vee Market Grille Expresses, the Hy-Vee owned and operated Wahlburgers locations, as well as the cafeteria at Hy-Vee’s West Des Moines corporate office. The dates these operations were impacted varied with general timeline beginning December 14, 2018, to July 29, 2019 for fuel pumps and from January 15, 2019, to July 29, 2019, for restaurants and drive-thru coffee shops. There are also six unspecified locations where the malware may have been in place as early as November 9, 2018 and one location where the issue continued through August 2, 2019.
The company
originally did not say what PII was involved, but now stated the malware
tracked payment card details including the cardholder’s name, card number,
expiration date and internal verification code. Not every POS system at the
affected locations contained the malware nor did the malware scrape every
payment card as it was run through the system. So in some instances a payment
card could have been used at an infected location yet not be compromised, the
company said. The exact number of people affected was not released.
“Payment card transactions were not involved at our
front-end checkout lanes; inside convenience stores; pharmacies; customer
service counters; wine & spirits locations; floral departments; clinics;
and all other food service areas which utilize point-to-point encryption
technology, as well as transactions processed through Aisles Online,” Hy-Vee
said.
The malware was removed and the company has instituted a
higher level of cybersecurity.
The company has provided a location lookup tool for customers to
check to see if their local facility was involved in the incident.
