Hy-Vee

Access to Hy-Vee’s environment was obtained through compromised Atlassian accounts, including tools such as Confluence and Jira. Internal documents, infrastructure diagrams, employee data, training materials, and technical information related to several operational systems were extracted. These include:

Hy-Vee, Inc. notified the New Hampshire Attorney General of a security incident involving malware on POS devices at fuel pumps and restaurants. The malware accessed payment card track data (card numbers, expiration dates) from November 2018 through July 2019. The breach affected 8 New Hampshire residents. Hy-Vee engaged cybersecurity firms, notified law enforcement and card networks, removed the malware, and implemented enhanced security measures.

Hy-Vee, Inc. notified Montana of a malware incident affecting POS devices at fuel pumps, restaurants, and drive-thrus. Unauthorized access occurred between Nov 2018 and Aug 2019. Malware captured payment card track data. Hy-Vee engaged cybersecurity firms, notified law enforcement and card networks, and removed the malware. No specific individual count was provided in this notice.

Hy-Vee, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2019-10-31. 40 Massachusetts residents were affected. The report records the breach type as electronic.