4.2 Million Credit and Debit Card Accounts Exposed In Supermarket Security Breach

Buy an ad on DigitalJournal.com

Hannaford Bros said that the information was stolen during the card authorization process at the checkout counter and estimate over four million unique account numbers were stolen.

The security attack affected all of the stores' almost 300 locations and at this time has been the cause of almost 2,000 cases of fraud. Hannaford says that personal info such as names, address and phone numbers were not stolen; the thieves only took the account numbers.

The security breach was noticed on Feb 27 and an investigation revealed that account numbers had been being swiped since Dec. 7 2007. According to Carol Eleazer, Hannaford's vice president of marketing in Scarborough it took until March 10th 2008 to contain the breach

"We have taken aggressive steps to augment our network security capabilities," Hannaford president and CEO Ronald C. Hodge said in a statement released Monday. "Hannaford doesn't collect, know or keep any personally identifiable customer information from transactions."

Hannaford has urged its customers to watch their accounts very closely for any unusual activity and report problems to the proper authorities.

The public is outraged that the breach was not made public until now. Bruce Spitzer, a spokesman for the Massachusetts Bankers Association, was quoted, saying:

"Visa and MasterCard have stipulated in their contracts with retailers that they will not divulge who the source is when a data breach occurs," Spitzer said. "We've been engaged in a dialogue for a couple years now about changing this rule.... Without knowing who the retailer is that caused the breach, it's hard for banks to conduct a good investigation on behalf of their consumers. And it's a problem for consumers as well, because if they know which retailer is responsible, they can rule themselves out for being at risk if they don't shop at that retailer."

The U.S. Secret Service have confirmed that they are on the case but could disclose no details and declined to comment to press.