Albertsons Companies, Inc.

Item 1C cybersecurity disclosure describes the registrant's risk management program, governance structure (Audit Committee, Technology Committee, CISO reporting to CTTO), use of third-party MSSPs and NIST CSF assessments, and tabletop exercises. The filer states it has not identified any cybersecurity threats that have materially affected, or are reasonably anticipated to materially affect, the Company. No specific cybersecurity incident is disclosed.

Albertsons Companies, Inc., a business sector entity reported a other incident to the Washington Attorney General. The organization became aware of the incident on 2025-07-14 and filed notice on 2025-12-18. 515 Washington residents were affected. 157 days elapsed between awareness and notification. 0 days to identify the breach. 7 days to contain the breach.

Albertsons Companies, Inc. is one of the largest food and drug retailers in the United States, serving millions of customers each week. The company operates stores across 35 states and the District of Columbia under 20 leading banners including Albertsons, Safeway, Vons, and Jewel-Osco. In addition to its retail operations, Albertsons also has a health and wellness business and a private brand portfolio.

Albertsons Companies Inc. is one of the largest American grocery corporations, founded by Joe Albertson in 1939. It operates stores across 34 states under 20 well-known banners including Albertsons, Safeway, Vons, Jewel-Osco, Shaw’s, Acme, Tom Thumb, Randalls, United Supermarkets, Pavilions, Star Market, and Carrs. It remains a leader in the supermarket industry, offering grocery products, pharmacy services, and specialty food products.

Albertsons Companies, Inc reported a data breach to the Montana Attorney General. The breach was reported on 2024-02-09. The breach occurred from 12/19/2023 to 1/12/2024. 10 Montana residents were affected.

Albertsons Companies, Inc. reported a data breach impacting 4 Maine residents which occurred between December 19, 2023, and January 12, 2024. The breach was discovered on January 10, 2024, and involved a fraudulent website leading to credential theft. The compromised information included names and Social Security numbers. The company has offered 24 months of credit monitoring and identity theft protection services through IDX to affected individuals.

Albertsons Companies, Inc reported a data breach to the Indiana Attorney General. The breach occurred on 2023-12-19 and was reported on 2024-02-09. 2 Indiana residents were affected. 457 individuals affected in total.

Albertsons Companies, Inc. reported a data breach affecting approximately 1 million individuals. The incident involved unauthorized access to a third-party service provider's systems, resulting in the exfiltration of customer PII. The company engaged forensic investigators and notified law enforcement.

Albertsons Companies, Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2023-04-21. The breach occurred during 12/22/2022 - 12/24/2022. The breach was discovered on 3/24/2023. 32,878 individuals were affected. Notice was sent on 4/21/2023.

Albertsons Companies, Inc reported a data breach to the Montana Attorney General. The breach was reported on 2023-04-21. The breach occurred from 12/22/2022 to 12/24/2022. 178 Montana residents were affected.

Albertsons Companies, Inc. reported a data breach affecting 32,878 individuals, which occurred from December 22, 2022, to December 24, 2022. The breach was discovered on March 24, 2023. The cause was an external system breach (hacking), and compromised information included names and driver's license or non-driver identification card numbers. Affected individuals were notified in writing on April 21, 2023, and offered 12 months of credit monitoring and identity theft protection services.

Albertsons Companies, Inc. reported a data security incident where an unauthorized third party gained access to systems and infected them with malware between December 22-24, 2022. The actor accessed and removed copies of data from file servers. Affected individuals may have had their names and other personal information exposed. Albertsons engaged forensics, contacted law enforcement, and offered credit monitoring.

Albertsons Companies, Inc., a business sector entity reported a ransomware incident to the Washington Attorney General. The organization became aware of the incident on 2022-12-23 and filed notice on 2023-04-20. 1,882 Washington residents were affected. 118 days elapsed between awareness and notification. 1 days to identify the breach. 1 days to contain the breach.

Albertsons Companies, Inc. notified consumers of a data breach occurring December 22-24, 2022. An unauthorized third party gained access to systems, infected them with malware, and exfiltrated personal information including names and variable data. Albertsons engaged forensic investigators and law enforcement, and offered credit monitoring to affected individuals.