Data breach at Supervalu

Supervalu has suffered a data breach that may have resulted in theft of customer payment card data. The stolen information may include account numbers, and in some cases also the expiration date, other numerical information and/or the cardholder’s name.



In a press release, Supervalu said that it has not determined that any cardholder data was actually stolen during the intrusion, or has been misused. Supervalu believes that the payment cards from which such cardholder data may have been stolen were used during the period of June 22 (at the earliest) through July 17 (at the latest), 2014, at 180 Supervalu stores and stand-alone liquor stores operated under the Cub Foods, Farm Fresh, Hornbacher’s, Shop ’n Save and Shoppers Food & Pharmacy banners. The intrusion may also have resulted in the theft of cardholder data from some cards used during this period at 29 franchised Cub Foods stores and stand-alone liquor stores.



Supervalu currently believes that the intrusion did not affect any of its owned or licensed Save-A-Lot stores or any of the independent grocery stores supplied by the company through its Independent Business network, other than franchised Cub Foods stores.



Upon recognition of the intrusion, Supervalu took immediate steps to secure the affected part of its network. An investigation supported by third-party data forensics experts is on-going to understand the nature and scope of the incident. Supervalu says it believes the intrusion has been contained and is confident that its customers can safely use their credit and debit cards in its stores.



“The safety of our customers’ personal information is a top priority for us,” said president and CEO Sam Duncan. “The intrusion was identified by our internal team, it was quickly contained, and we have had no evidence of any misuse of any customer data. I regret any inconvenience that this may cause our customers but want to assure them that it is safe to shop in our stores.”



Supervalu is cooperating with law enforcement and major payment card brands in an investigation of the intrusion. The retailer is offering customers whose payment cards may have been affected 12 months of complimentary consumer identity protection services through AllClear ID, and has established a call center to answer customer questions.