HackingRetail & ConsumerHealthcareRetailVulnerability ExploitSupply Chain (3P Vendor)TargetedIdentity (basic)Health (basic)PIIMediumContained

THE KROGER CO.

bd_671cf94121284673 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 23, 2021

Filed

Feb 22, 2021

To disclose

4 weeks

Affected

33,900state residents only

Linked

8 filings

Confidence

65%

Full breach record for THE KROGER CO. →7 incidents on file

The Kroger Co. notified South Carolina residents of a data breach involving Accellion, a third-party secure file transfer service. An unauthorized party exploited a vulnerability in Accellion's service to access files containing associate benefit information, including names, contact info, DOB, and health plan details. Kroger discontinued the service, reported to law enforcement, and offered 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due4 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 4 weeks / 30 days

Jan 23, 2021

Discovered

Feb 22, 2021

Filed

vs. sector median

5 wks faster

This filing is one of 8 filings about the same incident.View merged incident

Part of Accellion supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

HHS OCRbd_3e0294adc07168622021-02-19 · +3dVerified by operator
California State AGbd_6aaa39c445f321cc2021-02-19 · +3dVerified
Washington State AGbd_be0af4b58344c9362021-02-19 · +3dVerified
Indiana State AGbd_d1b8496772be04482021-02-19 · +3dVerified by operator

Show 3 more filings ↓up to 23d gap

Massachusetts State AGbd_df83dda5fb6772592021-02-19 · +3dVerified by operator
Montana State AGbd_f38fff6774acc2fe2021-02-19 · +3dVerified by operator
Montana State AGbd_ce7542d02671c8312021-03-17 · +23dVerified by operator

Name: THE KROGER CO.
norm: the kroger
Domain: kroger.com

Name: THE KROGER CO.
norm: the kroger
Domain: kroger.com
Industry: Retail & ConsumerllmHealthcarellm

Discovered: Jan 23, 2021
Materiality determined: —
Notification sent: Feb 19, 2021
Affected individuals: 33,900state-resident count only
Data types: Identity (basic)Health (basic)PII
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Reported the incident to federal law enforcement
Initial access: exploit_public_facing

During the incident: Discontinued use of Accellion's services
Reported the incident to federal law enforcement
Began an investigation to understand the scope and impact of the incident
Arranged for any impacted associate to receive comprehensive credit monitoring and identity theft protection services through Experian for two years at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

HHS OCRFeb 19 · first

California State AGFeb 19 · first

Washington State AGFeb 19 · first

Indiana State AGFeb 19 · first

Massachusetts State AGFeb 19 · first

Montana State AGFeb 19 · first

South Carolina State AG+3d · this page

Montana State AG+26d

Pattern: first filing Feb 19 (OH), last Mar 17 (MT) — a 26-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2021/Kroger.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 22, 2021
Raw hash: abebca7977296ac13b76d5437951a39264fd799c347f493295ef544fe26133bf

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityTHE KROGER CO.

Victim entityTHE KROGER CO.

Incidentdiscovered Jan 23, 2021

Stated responseDiscontinued use of Accellion's services

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov