HackingRetail & ConsumerRetailBrute ForceStolen CredentialsCustomer Data InvolvedIdentity (basic)CredentialsFinancial credentialsLowContained

Southeastern Grocers

bd_6fe7e5d1350d20e5 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 22, 2020

Filed

Nov 12, 2020

To disclose

7 weeks

Affected

4state residents only

Linked

4 filings

Confidence

66%

All records for Southeastern Grocers →

Account takeover notice

Southeastern Grocers notified customers of unauthorized access to their accounts. The filing says: “On September 22 and September 23, 2020, criminal actors committed two brute-force password attacks on the Company's website , www.winndixie.com, using a method called credential stuffing.”

Southeastern Grocers, Inc. (dba Winn-Dixie) reported a credential stuffing attack on its website on September 22-23, 2020. Criminal actors used stolen credentials to brute-force access customer loyalty accounts. The company detected the intrusion on the same day and contained it. Affected data included names, phone numbers, emails, dates of birth, reward numbers, PINs, and points balances. Four New Hampshire residents were affected. Passwords were reset and forensic investigators were engaged.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 weeks / 51 days

Sep 22, 2020

Begins

Sep 22, 2020

Discovered

Nov 12, 2020

Filed

vs. sector median

2 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_a42004e3755c5d422020-11-13 · +1dVerified
Maine State AGbd_f1bacd93619ba5922020-11-13 · +1dVerified
Indiana State AGbd_b3109643d8d6a7dc2020-10-05 · +38dVerified

Name: Southeastern Grocers
norm: southeastern grocers
Domain: segrocers.com

Name: Southeastern Grocers
norm: southeastern grocers
Domain: segrocers.com
Industry: Retail & Consumerllm

Discovered: Sep 22, 2020
Account access: Sep 22, 2020 – Sep 23, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 25, 2020
Affected individuals: 4state-resident count only
Data types: Identity (basic)CredentialsFinancial credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1110 Brute Force
Threat actor: External
Regulator citations: Provided Notice of Security Breach to the New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Acted immediately to contain the attacks by addressing system security to stop the malicious activity
Gathered and stored all relevant system logs for analysis
Engaged its forensic incident response partner to further analyze, review, and verify the details of the incident
Reset affected user credentials to random passwords
Sent email notifications to impacted customers on September 25, 2020 and October 5, 2020
Working closely with forensic investigators, legal counsel and law enforcement
Changes made: Adopted additional security measures to help prevent a recurrence of such an attack
Created new protections in our system to better identify and prevent these attacks from occurring in the future
Investigating further security measures as it concludes the investigation
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(51 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Indiana State AGOct 5 · first

New Hampshire State AG+38d · this page

Massachusetts State AG+39d

Maine State AG+39d

Pattern: first filing Oct 5 (IN), last Nov 13 (ME) — a 39-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/southeastern-grocers-winn-dixie-20201112.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 12, 2020
Raw hash: bff3c8c1212e4a4c5734f95afebecb8858ed497bb874ee5f6d55f21ffff4e3c4

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySoutheastern Grocers

Victim entitySoutheastern Grocers

Incidentdiscovered Sep 22, 2020

Stated responseActed immediately to contain the attacks by addressing system security to stop the malicious activity

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov