HackingRetail & ConsumerHealthcareRetailVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)EmploymentFinancial accountHighContained

THE KROGER CO.

bd_f38fff6774acc2fe · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 23, 2021

Filed

Feb 19, 2021

To disclose

27 days

Affected

5,600state residents only

Linked

8 filings

Confidence

65%

Full breach record for THE KROGER CO. →7 incidents on file

The Kroger Co. notified Montana residents of a data breach involving Accellion, a third-party file transfer service. An unauthorized party exploited a vulnerability in Accellion's service on January 23, 2021, accessing files containing employee and patient data. Impacted data included names, contact info, SSNs, DOBs, and health/employment records. Kroger discontinued the service, notified law enforcement, and offered 2 years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 27 days

Jan 23, 2021

Begins

Jan 23, 2021

Discovered

Feb 19, 2021

Filed

vs. sector median

5 wks faster

This filing is one of 8 filings about the same incident.View merged incident

Part of Accellion supply-chain incident (2021) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

HHS OCRbd_3e0294adc07168622021-02-19Verified by operator
California State AGbd_6aaa39c445f321cc2021-02-19Verified
Washington State AGbd_be0af4b58344c9362021-02-19Verified
Indiana State AGbd_d1b8496772be04482021-02-19Verified by operator

Show 3 more filings ↓up to 26d gap

Massachusetts State AGbd_df83dda5fb6772592021-02-19Verified by operator
South Carolina State AGbd_671cf941212846732021-02-22 · +3dVerified
Montana State AGbd_ce7542d02671c8312021-03-17 · +26dVerified by operator

Name: THE KROGER CO.
norm: the kroger
Domain: kroger.com

Name: THE KROGER CO.
norm: the kroger
Domain: kroger.com
Industry: Retail & ConsumerllmHealthcarellm

Discovered: Jan 23, 2021
Breach occurred: Jan 23, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 19, 2021
Affected individuals: 5,600state-resident count only
Data types: Identity (basic)Government IDHealth (basic)EmploymentFinancial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: Reported the incident to federal law enforcement
Third party: via Accellion
Initial access: exploit_public_facing

During the incident: Discontinued use of the Accellion service
Reported the incident to federal law enforcement
Began an investigation to understand the scope and impact of the incident
Arranged for any impacted associate to receive comprehensive credit monitoring and identity theft protection services through Experian for two years at no cost to you
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 days(27 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

HHS OCRFeb 19 · first

California State AGFeb 19 · first

Washington State AGFeb 19 · first

Indiana State AGFeb 19 · first

Massachusetts State AGFeb 19 · first

Montana State AGFeb 19 · first · this page

South Carolina State AG+3d

Montana State AG+26d

Pattern: first filing Feb 19 (OH), last Mar 17 (MT) — a 26-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/krogSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 19, 2021
Raw hash: 2281444cea8711391c009577f3e8c6ad3829bd3edb9f7708935503588ad8f5e7

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityTHE KROGER CO.

Victim entityTHE KROGER CO.

Incidentdiscovered Jan 23, 2021

Stated responseDiscontinued use of the Accellion service

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov