Iowa-based grocery chain Hy-Vee appears to be moving toward a settlement to resolve a data breach it suffered.
On July 29, 2019, the company noticed unusual activity in some of its payment processing systems and initiated an investigation
As the investigation ultimately found, malware designed to access and steal payment card data had been installed at certain Hy-Vee gas pumps, as well as drive-thru cafes.
The company's restaurants were also affected, including Hy-Vee Market Grilles, Hy-Vee Market Grille Expresses and Wahlburgers , as well as the cafeteria at the chain's corporate office in West Des Moines.
As stated in October 2019, the timing of the breach of card data used at these locations varies. However, the company said that in general, gas pumps were affected from December 14, 2018 to July 29, 2019, while drive-thru restaurants and cafes were affected from January 15, 2019 to July 29, 2019.
“There are six locations where access to card data may have begun as early as November 9, 2018, and one location where access to card data may have continued until August 2, 2019,” the company said.
However, the company is concerned that its stores in Illinois, Kansas, Missouri, Montana, Nebraska, South Dakota and Wisconsin were also affected by the breach. The data stolen during the attack included customer names, credit and debit card numbers, card expiration dates and verification codes.
In October and November 2019, lawsuits were filed due to the breach by many customers in Illinois, Missouri, and Wisconsin, whose data had been compromised. These customers later collaborated and filed a complaint against Hy-Vee at the end of November 2019.
On January 12, a settlement was proposed that would allow those affected by the breach to file claims for damages, with a maximum amount of $225. The plaintiffs named in the lawsuit will receive an additional $2,000.
Under the proposal, customers who have suffered greater harm, such as being charged for purchases they did not make, can claim up to $5,000.
