HackingRetail & ConsumerHealthcareRetailVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedPIIPHIIdentity (basic)Government IDHealth (basic)EmploymentMediumContained

THE KROGER CO.

bd_6aaa39c445f321cc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 23, 2021

Filed

Feb 19, 2021

To disclose

27 days

Affected

Not disclosed

Linked

8 filings

Confidence

64%

Full breach record for THE KROGER CO. →7 incidents on file

Kroger notified customers and employees of a data breach involving Accellion file transfer service. An unauthorized party exploited a vulnerability in Accellion's service to access files containing personal information, including names, contact details, dates of birth, Social Security numbers, and health/employment data. The incident occurred between Dec 24-29, 2020, and was discovered on Jan 23, 2021. Kroger discontinued Accellion services, reported to law enforcement, and offered two years of credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jan 23, 2021 → Notified Feb 19, 202127d ✓ CA 60-day OK27 days discovery → filing

Incident timeline

undetected · 30 days

discovery → filing · 27 days

Dec 24, 2020

Begins

Jan 23, 2021

Discovered

Feb 19, 2021

Filed

vs. sector median

5 wks faster

This filing is one of 8 filings about the same incident.View merged incident

Part of Accellion supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

HHS OCRbd_3e0294adc07168622021-02-19Verified by operator
Washington State AGbd_be0af4b58344c9362021-02-19Verified
Indiana State AGbd_d1b8496772be04482021-02-19Verified by operator
Massachusetts State AGbd_df83dda5fb6772592021-02-19Verified by operator

Show 3 more filings ↓up to 26d gap

Montana State AGbd_f38fff6774acc2fe2021-02-19Verified by operator
South Carolina State AGbd_671cf941212846732021-02-22 · +3dVerified
Montana State AGbd_ce7542d02671c8312021-03-17 · +26dVerified by operator

Name: THE KROGER CO.
norm: the kroger
Domain: kroger.com

Name: THE KROGER CO.
norm: the kroger
Domain: kroger.com
Industry: Retail & ConsumerllmHealthcarellm

Discovered: Jan 23, 2021
Breach occurred: Dec 24, 2020 – Dec 29, 2020
Undetected for: 30 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 19, 2021
Affected individuals: Not disclosed
Data types: PIIPHIIdentity (basic)Government IDHealth (basic)Employment
Data elements: Social Security numberDate of birthMedical information
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain Compromise
Threat actor: External
Regulator citations: Reported the incident to federal law enforcement
Third party: via Accellion
Initial access: supply_chain

During the incident: Discontinued use of Accellion’s services
Reported the incident to federal law enforcement
Began an investigation to understand the scope and impact of the incident
Arranged for impacted individuals to receive comprehensive credit monitoring and identity theft protection services through Experian for two years at no cost
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: CA 60-day OK · 27d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jan 23, 2021
→ Notified: Feb 19, 2021
27d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jan 23, 2021 → Notified: Feb 19, 2021	27d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

HHS OCRFeb 19 · first

Washington State AGFeb 19 · first

Indiana State AGFeb 19 · first

Massachusetts State AGFeb 19 · first

Montana State AGFeb 19 · first

California State AGFeb 19 · first · this page

South Carolina State AG+3d

Montana State AG+26d

Pattern: first filing Feb 19 (OH), last Mar 17 (MT) — a 26-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-538150
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 19, 2021
Raw hash: 8f4aa1b5654673ceb02af5489a2528e1abae4722c121987217cd3ab6665f8c7c

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityTHE KROGER CO.

Victim entityTHE KROGER CO.

Incidentdiscovered Jan 23, 2021

Stated responseDiscontinued use of Accellion’s services

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov