HackingRetail & ConsumerFinancial ServicesRetailSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

THE KROGER CO.

bd_ce7542d02671c831 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 23, 2021

Filed

Mar 17, 2021

To disclose

8 weeks

Affected

8state residents only

Linked

8 filings

Confidence

66%

Full breach record for THE KROGER CO. →7 incidents on file

Western Union notified Montana AG that Kroger Company's third-party file transfer vendor (Accellion) was compromised. Unauthorized access occurred Dec 24-29, 2020; discovered Jan 23, 2021. Data exfiltrated included names, addresses, phone numbers, driver's licenses, and SSNs. 8 Montana residents affected. Notifications mailed March 17, 2021.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 30 days

discovery → filing · 8 weeks / 53 days

Dec 24, 2020

Begins

Jan 23, 2021

Discovered

Mar 17, 2021

Filed

vs. sector median

2 wks faster

This filing is one of 8 filings about the same incident.View merged incident

Part of Accellion supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

South Carolina State AGbd_671cf941212846732021-02-22 · +23dVerified
HHS OCRbd_3e0294adc07168622021-02-19 · +26dVerified by operator
California State AGbd_6aaa39c445f321cc2021-02-19 · +26dVerified
Washington State AGbd_be0af4b58344c9362021-02-19 · +26dVerified

Show 3 more filings ↓up to 26d gap

Indiana State AGbd_d1b8496772be04482021-02-19 · +26dVerified by operator
Massachusetts State AGbd_df83dda5fb6772592021-02-19 · +26dVerified by operator
Montana State AGbd_f38fff6774acc2fe2021-02-19 · +26dVerified by operator

Name: WESTERN UNION FINANCIAL SERVICES, INC.
norm: western union financial

Name: THE KROGER CO.
norm: the kroger
Domain: kroger.com
Industry: Retail & ConsumerllmFinancial Servicesllm

Discovered: Jan 23, 2021
Breach occurred: Dec 24, 2020 – Dec 29, 2020
Undetected for: 30 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 17, 2021
Affected individuals: 8state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
Threat actor: ExternalFinancial
Regulator citations: Notified Montana Office of the Attorney General Consumer Protection Division
Initial access: supply_chain

During the incident: Notified the Cincinnati office of the Federal Bureau of Investigation
Stopped using the affected file transfer service provided by Accellion
Initiated an investigation
Created a website for the incident
Changes made: Reviewing Kroger’s security practices
Monitoring the circumstances surrounding this event
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

HHS OCRFeb 19 · first

California State AGFeb 19 · first

Washington State AGFeb 19 · first

Indiana State AGFeb 19 · first

Massachusetts State AGFeb 19 · first

Montana State AGFeb 19 · first

South Carolina State AG+3d

Montana State AG+26d · this page

Pattern: first filing Feb 19 (OH), last Mar 17 (MT) — a 26-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/kroger-notif.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 17, 2021
Raw hash: 4795b13b1f860931345aaf45f608edf76dc736d1a23f5eeeb20474f53ea0e97e

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityWESTERN UNION FINANCIAL SERVICES, INC.

Victim entityTHE KROGER CO.

Incidentdiscovered Jan 23, 2021

Stated responseNotified the Cincinnati office of the Federal Bureau of Investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov