Social EngineeringRetail & ConsumerRetailPhishingBECData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPIIMediumActive

THE KROGER CO.

bd_3c2e6e77778fe2de · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 27, 2016

Filed

May 25, 2016

To disclose

28 days

Affected

20state residents only

Linked

4 filings

Confidence

65%

Full breach record for THE KROGER CO. →7 incidents on file

Kroger Co. notified Montana and other state residents of a data breach involving Equifax W-2Express accounts. Attackers used stolen SSNs and DOBs obtained via phishing to access W-2 forms of current and former associates. Discovery was April 27, 2016. Kroger engaged FBI/IRS and provided credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 87 days

discovery → filing · 28 days

Jan 31, 2016

Begins

Apr 27, 2016

Discovered

May 25, 2016

Filed

vs. sector median

5 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

New Hampshire State AGbd_941296feb0c5f1d82016-05-25Verified
Massachusetts State AGbd_429717f851e35f322016-05-26 · +1dVerified
Oregon State AGbd_cd48f1a8ec596f942016-05-27 · +2dVerified

Name: THE KROGER CO.
norm: the kroger
Domain: kroger.com

Name: THE KROGER CO.
norm: the kroger
Domain: kroger.com
Industry: Retail & Consumerllm

Discovered: Apr 27, 2016
Breach occurred: Jan 31, 2016
Undetected for: 87 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 16, 2016
Affected individuals: 20state-resident count only
Data types: Identity (basic)Government IDPII
Attack vector: Phishing
MITRE ATT&CK: T1078 Valid AccountsT1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: working closely with federal law enforcement and the IRS in their investigation
Initial access: phishing_link

During the incident: Began working closely with Equifax, the Internal Revenue Service (IRS) and the FBI
Equifax has reset PINs for those associates with the default PIN
Provided information on potentially affected individuals in order to help the IRS detect and deter the filing of fake tax returns
Arranged for identity and credit monitoring services at no cost to you
Changes made: Secured the services of Kroll to provide identity monitoring services at no cost to you for one year
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGMay 25 · first

Montana State AGMay 25 · first · this page

Massachusetts State AG+1d

Oregon State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Kroger-Co..pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 25, 2016
Raw hash: 466999155701e63383d9ca6c9861990a2802033d4bd77705e86fb1f67405ec5d

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityTHE KROGER CO.

Victim entityTHE KROGER CO.

Incidentdiscovered Apr 27, 2016

Stated responseBegan working closely with Equifax, the Internal Revenue Service (IRS) and the FBI

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov