HackingRetail & ConsumerRetailStolen CredentialsBECData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancialMediumActive

THE KROGER CO.

bd_941296feb0c5f1d8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 27, 2016

Filed

May 25, 2016

To disclose

28 days

Affected

2state residents only

Linked

4 filings

Confidence

66%

Full breach record for THE KROGER CO. →7 incidents on file

The Kroger Co. notified the NH AG of a data security incident involving employee W-2 data. Unknown individuals accessed Equifax W-2Express using default login info based on SSNs and DOBs obtained from a prior breach. Incident discovered April 27, 2016. Notification sent May 25, 2016. Approx 2 NH residents affected. Data included names, addresses, SSNs, income info. Identity monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 91 days

discovery → filing · 28 days

Jan 27, 2016

Begins

Apr 27, 2016

Discovered

May 25, 2016

Filed

vs. sector median

5 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_3c2e6e77778fe2de2016-05-25Candidate
Massachusetts State AGbd_429717f851e35f322016-05-26 · +1dVerified
Oregon State AGbd_cd48f1a8ec596f942016-05-27 · +2dVerified

Name: Sidley Austin LLP
norm: sidley austin

Name: THE KROGER CO.
norm: the kroger
Domain: kroger.com
Industry: Retail & Consumerllm

Discovered: Apr 27, 2016
Breach occurred: Jan 27, 2016
Undetected for: 91 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 25, 2016
Affected individuals: 2state-resident count only
Data types: Identity (basic)Government IDFinancial
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Contacted federal law enforcement at the FBI and the IRSWorking closely with federal law enforcement and the IRS in their investigation
Initial access: valid_credentials

During the incident: Contacted federal law enforcement at the FBI and the IRS
Provided preliminary notice about the incident internally to all current employees on May 3
Followed up with a communication with instructions to reset default pins on May 5, 2016
Notifying all potentially affected individuals, including current and former employees, in a formal letter on May 25, 2016
Offering free identity monitoring services from Kroll Inc. for one year
Offering free access to Kroll’s licensed investigators for identity consultation and identity restoration support for three years
Changes made: Equifax has reset PINs for those associates with the default PIN
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGMay 25 · first

New Hampshire State AGMay 25 · first · this page

Massachusetts State AG+1d

Oregon State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/kroger-20160525.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 25, 2016
Raw hash: 3d51c2ef3931d435aaa370479f46e5f1d61e4ae40138b60d91e08956e6fec113

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entitySidley Austin LLP

Victim entityTHE KROGER CO.

Incidentdiscovered Apr 27, 2016

Stated responseContacted federal law enforcement at the FBI and the IRS

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov